Improper neutralisation of input during web page generation in the Podlove Subscribe button plugin allows a stored cross‑site scripting (XSS) flaw. An attacker could inject malicious JavaScript that executes in the browser of any site visitor when the compromised content is rendered, potentially enabling session hijacking, defacement, or redirection.

Alexander Lueken’s Podlove Subscribe button plugin for WordPress. Any install of version 1.3.11 or earlier is vulnerable. The defect is present in all releases from the first version through the dated limit. Versions released after 1.3.11 are not affected.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests that the exploitation probability in the general threat landscape is currently low, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability can be exploited via stored XSS, requiring an attacker to submit malicious input through the plugin’s interface that is then persisted and served to all users who view the affected page. No additional authentication or privilege escalation is mentioned in the description, implying that a publicly exploitable attack vector exists as long as the plugin accepts unsanitised user input.