The vulnerability allows an attacker who can access the Podlove Podcast Publisher webhook endpoint to submit any POST payload with a status_string that is not the literal string 'Done'. The plugin records the entire raw POST superglobal into its logging storage before validating any authentication key, meaning the untrusted data is written to a log file. When this log is later displayed in an authenticated user interface, the unescaped content will be rendered as part of the page, giving the attacker the ability to inject arbitrary JavaScript that executes in the context of the site for any visitor who views the page. This results in a stored cross‑site scripting flaw that can be triggered without authentication.

Any WordPress installation that is running the Podlove Podcast Publisher plugin version 4.5.6 or earlier is affected. The plugin is distributed under the vendor identifier eteubert:Podlove Podcast Publisher and is commonly used to host podcast feeds. The issue applies across all minor versions up to and including 4.5.6, and specific patch notes exist for later releases that remove the unsanitized logging behavior.

The CVSS score is 7.2, indicating a high level of impact and moderate exploitation difficulty. EPSS is not available, so the probability of exploitation is currently unknown; the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and does not require any prior authentication, leveraging the publicly accessible Auphonic webhook endpoint. An attacker can execute the exploit by crafting a POST request that bypasses the intended status check and injects malicious script into the log. When Site users view pages that expose that log data, the malicious code will run in their browsers, potentially leading to session hijacking, defacement, or further exploitation of other vulnerabilities within the site.