CVE-2026-93775: Stored Cross-Site Scripting in Podlove Podcast Publisher

The Podlove Podcast Publisher plugin for WordPress (versions 4.5.6 and earlier) is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-93775. The flaw originates in the plugin's Auphonic Webhook endpoint, which lacks sufficient input sanitization and output escaping. When an unauthenticated attacker sends a POST request to this endpoint containing a status_string field that does not equal 'Done', the plugin logs the entire raw POST superglobal data. Because this data is stored in the application logs without authentication key validation, malicious JavaScript payloads can be persisted. These scripts execute in the browser of any user who subsequently views the logs, enabling potential session hijacking, unauthorized administrative actions, or credential theft. Given that the attack requires no authentication, it represents a high-risk vector for WordPress deployments using the affected plugin.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of an administrator or other user viewing the plugin logs. This can lead to the complete compromise of administrative accounts, unauthorized configuration changes, or the injection of further malicious content into the WordPress site.

Recommendation

• Upgrade the Podlove Podcast Publisher plugin to the latest version beyond 4.5.6 immediately.
• Until patching is possible, restrict access to the webhook endpoint or disable the Auphonic Webhook feature if not required.
• Review WordPress access logs for anomalous POST requests directed at the plugin's webhook endpoint that deviate from expected patterns.