Eteubert Podlove Podcast Publisher vulnerabilities

CVE-2025-10147 [CRITICAL] CWE-434 CVE-2025-10147: The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to mi The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_as_original_file' function in all versions up to, and including, 4.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code e

CVE-2025-1383 [MEDIUM] CWE-352 CVE-2025-1383: The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in al The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. This is due to missing or incorrect nonce validation on the ajax_transcript_delete() function. This makes it possible for unauthenticated attackers to delete arbitrary episode transcripts via a forged request gran

CVE-2025-0554 [MEDIUM] CWE-79 CVE-2025-0554: The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version <= 4.1.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a

CVE-2024-1110 [MEDIUM] CWE-862 CVE-2024-1110: The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of dat The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings.

CVE-2024-1109 [MEDIUM] CWE-862 CVE-2024-1109: The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_download() and init() functions in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to export the plugin's tracking data and podcast information.