CVE-2024-13730: Podlove Podcast Publisher < 4.2.1 - Admin+ Stored XSS
The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13730?
CVE-2024-13730 is classified as a high severity vulnerability due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-13730?
To fix CVE-2024-13730, update the Podlove Podcast Publisher plugin to version 4.2.1 or later.
Who is affected by CVE-2024-13730?
CVE-2024-13730 affects users of the Podlove Podcast Publisher WordPress plugin versions prior to 4.2.1.
What type of attack is associated with CVE-2024-13730?
CVE-2024-13730 allows high privilege users to conduct Stored Cross-Site Scripting attacks.
Is there a workaround for CVE-2024-13730?
There is no official workaround for CVE-2024-13730 other than updating to the patched version.