The fresh Podcaster WordPress plugin contains a stored cross‑site scripting flaw caused by insufficient sanitization and escaping of attributes supplied to the 'freshpodcaster' shortcode. This flaw allows a malicious attacker to inject arbitrary JavaScript that will execute whenever a user views a page containing the shortcode, potentially impacting the confidentiality or integrity of the site. No additional impacts such as credential theft or defacement are explicitly documented in the CVE description.

The vulnerability exists in all versions of the fresh Podcaster plugin up to and including 1.0.7. It requires only authenticated access with contributor‑level privileges or higher, after which the attacker can insert malicious attributes into any content that uses the 'freshpodcaster' shortcode.

The CVSS score of 6.4 classifies the issue as moderate severity, while an EPSS score of < 1% indicates the current probability of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog, and from the description the attack vector is an authenticated user with contributor or higher privileges who can embed the shortcode; once inserted, the payload is executed for all visitors to the affected page.