CVE-2025-1383: Podlove Podcast Publisher <= 4.2.2 - Cross-Site Request Forgery via ajax_transcript_delete Function
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. This is due to missing or incorrect nonce validation on the ajaxtranscriptdelete() function. This makes it possible for unauthenticated attackers to delete arbitrary episode transcripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1383?
CVE-2025-1383 has a moderate severity rating due to the potential for Cross-Site Request Forgery attacks.
How do I fix CVE-2025-1383?
To fix CVE-2025-1383, you should upgrade the Podlove Podcast Publisher plugin to version 4.2.3 or later.
Who is affected by CVE-2025-1383?
Users of all versions of the Podlove Podcast Publisher plugin for WordPress up to and including 4.2.2 are affected by CVE-2025-1383.
What type of vulnerability is CVE-2025-1383?
CVE-2025-1383 is categorized as a Cross-Site Request Forgery vulnerability.
What function is responsible for the vulnerability in CVE-2025-1383?
The ajax_transcript_delete() function is responsible for the vulnerability in CVE-2025-1383 due to missing nonce validation.