An improper neutralization of input during web page generation vulnerability, known as Stored XSS, exists in the Castos Seriously Simple Podcasting plugin. The flaw allows attackers to inject malicious script code that is stored within the plugin’s content fields, which is later rendered in the website’s pages. When users view those pages, the injected code executes in their browsers, potentially compromising session cookies, defacing content, or redirecting victims. This risk directly threatens confidentiality, integrity, and availability for anyone who views the affected content.

The vulnerability affects the WordPress Seriously Simple Podcasting plugin version 3.17.0 and earlier. Only installations of the plugin from the Castos product line that have not been upgraded to 3.17.1 or later are susceptible.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploit prevalence is not confirmed to be high. Attackers would need to insert malicious payloads through the plugin’s input fields, which are persisted in the database and displayed to site visitors. Because the data is rendered without proper escaping, the exploit can be triggered simply by visiting the page, making the attack vector largely web‑based and exploitable by anyone with access to data entry points within the plugin.