The vulnerability stems from insufficient sanitization of the Feed Name field in Podlove Podcast Publisher. Attackers with administrator privileges can store malicious JavaScript in this field, which is then rendered without escaping. When a user opens the affected page, the browser executes the embedded script, enabling theft of session data or other malicious actions. This is a Stored Cross‑Site Scripting flaw classified as CWE‑79.

The flaw affects installations of Podlove Podcast Publisher version 4.1.25 or earlier on WordPress. It only manifests on multi‑site setups where the unfiltered_html capability is disabled. The affected vendor is eteubert and the product is Podlove Podcast Publisher.

The CVSS score of 4.4 indicates moderate severity, while the EPSS score of less than 1% shows a very low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Because the attacker must be an administrator and the attack occurs when a user views the injected content, the vector is local with potential impact on all site visitors who render the page.