CVE-2026-93775: Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injection is triggered by submitting a request to the Auphonic webhook endpoint with any POST body where the statusstring field is not the literal string 'Done', causing the full raw POST superglobal to be stored in the plugin log before any authentication key validation is performed.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker can send a POST request to the Auphonic webhook endpoint without authentication. The request must include a status_string value other than the literal string "Done"; the plugin stores the raw POST data before validating any authentication key.
Who is exposed to the injected script?
Any user who accesses a page where the injected plugin log content is rendered may execute the stored script. Because exploitation requires no privileges or user interaction from the attacker, publicly reachable WordPress installations running an affected version are exposed to injection attempts.
How can I check for attempted or successful exploitation?
Review Podlove plugin log entries associated with the Auphonic webhook for unexpected POST data, especially requests whose status_string is not "Done". Look for script content or other untrusted markup in stored raw request data.