The vulnerability is an Improper Neutralization of Input During Web Page Generation (Cross‑Site Scripting) that allows an attacker to inject and store arbitrary script code within pages served by the Seriously Simple Podcasting plugin. Successful exploitation would let an attacker execute code in the browser context of any visitor, facilitating cookie theft, defacement, or redirection. This is a classic Stored XSS weakness identified as CWE‑79.

Craig Hewitt’s Seriously Simple Podcasting plugin for WordPress is affected, specifically all releases from the initial version up through 3.14.1. Users running any version of the plugin at or below 3.14.1 remain vulnerable.

The CVSS score of 6.5 indicates a moderate severity, but the EPSS score of less than 1% shows that current exploitation activity is anticipated to be very low. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no documented active exploitation. The attack vector is inferred to require authenticated or privileged users who can submit or edit podcast entries, as the stored data is accepted without proper neutralization. A successful exploit could compromise the confidentiality, integrity, and availability of site users through script injection.