Podcast Generator 3.1 allows an authenticated user to persistently inject JavaScript into the long_description field of episodes. When other users view those episodes, the stored script executes in their browsers, enabling theft of session cookies, defacement, or other malicious actions. This is a classic stored cross‑site scripting flaw classified as CWE‑79. The impact attacks confidentiality and integrity of user data but does not provide remote code execution or system privilege escalation beyond the attacker’s credentials.

The affected product is Podcast Generator 3.1, distributed by Podcastgenerator. All installations that have not applied an official patch or upgrade are vulnerable; the flaw is limited to the episode long_description parameter in the web interface.

The CVSS score of 5.1 indicates moderate risk. The EPSS score is not available, so the exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog, implying no documented widespread attacks. Attackers must be authenticated to submit or edit an episode, so the threat surface is somewhat constrained. However, once an episode with malicious content is viewed, the victim’s browser executes arbitrary JavaScript, which can lead to credential theft or further attacks against the website.