CVE-2025-0554

Podlove Podcast Publisher <= 4.1.25 - Authenticated (Admin+) Stored Cross-Site Scripting via Feed Name

Published Jan 18, 2025 CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Description

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version <= 4.1.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Analysis

Technical impact

The vulnerability stems from insufficient sanitization of the Feed Name field in Podlove Podcast Publisher. Attackers with administrator privileges can store malicious JavaScript in this field, which is then rendered without escaping. When a user opens the affected page, the browser executes the embedded script, enabling theft of session data or other malicious actions. This is a Stored Cross‑Site Scripting flaw classified as CWE‑79.

Affected Systems

The flaw affects installations of Podlove Podcast Publisher version 4.1.25 or earlier on WordPress. It only manifests on multi‑site setups where the unfiltered_html capability is disabled. The affected vendor is eteubert and the product is Podlove Podcast Publisher.

Risk and Exploitability

The CVSS score of 4.4 indicates moderate severity, while the EPSS score of less than 1% shows a very low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Because the attacker must be an administrator and the attack occurs when a user views the injected content, the vector is local with potential impact on all site visitors who render the page.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

eteubert

Podlove Podcast Publisher

unaffected

Version	Status	Constraints
`0`	affected	≤ 4.1.25

Configuration 1 [-]

cpe:2.3:a:podlove:podlove_podcast_publisher:*:*:*:*:*:wordpress:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Podlove Podcast Publisher to version 4.1.26 or later to apply the vendor’s fix.
Review and sanitize existing Feed Names that may contain injected scripts, removing any embedded code.
Restrict the unfiltered_html capability to trusted administrators only, disabling it for lower‑privilege users to prevent accidental malicious injections.

Generated by OpenCVE AI on April 22, 2026 at 13:33 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-1752	The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version <= 4.1.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.279% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3217075%40podlove-podcasting-plugin-for-wordpress&new=3217075%40podlove-podcasting-plugin-for-wordpress&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/39d41772-49f3-4bce-a170-cbe64ba99184?source=cve

History

Mar 19, 2025 8:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Podlove Podlove podlove Podcast Publisher
CPEs		cpe:2.3:a:podlove:podlove_podcast_publisher::::::wordpress::*
Vendors & Products		Podlove Podlove podlove Podcast Publisher

Jan 22, 2025 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 18, 2025 5:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version <= 4.1.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Title		Podlove Podcast Publisher <= 4.1.25 - Authenticated (Admin+) Stored Cross-Site Scripting via Feed Name
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3217075%40podlove-podcasting-plugin-for-wordpress&new=3217075%40podlove-podcasting-plugin-for-wordpress&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/39d41772-49f3-4bce-a170-cbe64ba99184?source=cve
Metrics		cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N'}`