Technical impact
Improper neutralization of input during web page generation results in a stored XSS flaw within the Seriously Simple Podcasting plugin. This flaw is classified as CWE-79. An attacker can inject malicious scripts that execute in the browsers of anyone who views podcast pages, potentially enabling cookie theft, session hijacking, or defacement of the displayed content. The vulnerability does not provide remote code execution but can severely compromise user data confidentiality and the integrity of the web interface.
Affected Systems
The flaw affects users of Seriously Simple Podcasting version 3.9.0 or earlier on WordPress sites. The plugin is developed by Craig Hewitt. No specific WordPress core versions are listed as affected; the issue resides solely in the plugin’s handling of user‑supplied content.
Risk and Exploitability
The CVSS score of 5.9 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker submitting content via the plugin’s administrative interface; once stored, the payload is delivered to any visitor reading the affected podcast page. Permission levels such as site administrators or editors who can add or edit podcast entries are required to launch the attack, but the resulting impact is confined to client‑side execution.
EUVD