CVE-2026-75966: Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episodecontributor[..][..][comment]' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core's wpksespost filter, and the savepost hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Contributor-level access or higher can exploit it, provided they can edit posts. No additional user interaction or preconditions are required for the attacker to save the payload.
Are sites affected by default?
Sites using Podlove Podcast Publisher version 4.5.5 or earlier are affected if users with Contributor-level or higher access can edit posts. The vulnerable contributor comment is stored in a plugin-managed custom table rather than being filtered by WordPress core's wp_kses_post mechanism.
What happens after a malicious comment is saved?
The injected script is stored and executes in the browser whenever a user accesses the affected page. This can expose or alter content available in the viewing user's browser context.
What can be done if updating is not immediately possible?
Restrict post-editing access to trusted users, particularly Contributor accounts, and review contributor-comment content associated with editable posts for suspicious script payloads. Removing untrusted Contributor-level accounts reduces the set of users able to exploit the issue.