What’s Vulnerable › Products

Podlove Podcast Publisher vulnerabilities

29 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Check whether your Podlove Podcast Publisher version is affected

Latest Podlove Podcast Publisher vulnerabilities

• CVE-2026-93775 — Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook (CVSS 7.2)
• CVE-2026-75966 — Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter (CVSS 6.4)
• CVE-2026-66615 — WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-16099 — Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter (CVSS 8.8)
• CVE-2026-13729 — Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF (CVSS 4.3)
• CVE-2026-13001 — Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter (CVSS 9.8)
• CVE-2026-32448 — WordPress Podlove Podcast Publisher plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2025-10147 — Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Upload (CVSS 9.8)
• CVE-2025-58204 — WordPress Podlove Podcast Publisher Plugin <= 4.2.5 - Open Redirection Vulnerability (CVSS 4.7)
• CVE-2024-13730 — Podlove Podcast Publisher < 4.2.1 - Admin+ Stored XSS (CVSS 4.8)
• CVE-2024-13729 — Podlove Podcast Publisher < 4.1.24 - Admin+ Stored XSS (CVSS 4.8)
• CVE-2025-1383 — Podlove Podcast Publisher <= 4.2.2 - Cross-Site Request Forgery via ajax_transcript_delete Function (CVSS 4.3)
• CVE-2025-0554 — Podlove Podcast Publisher <= 4.1.25 - Authenticated (Admin+) Stored Cross-Site Scripting via Feed Name (CVSS 4.0)
• CVE-2024-52393 — WordPress Podlove Podcast Publisher plugin <= 4.1.15 - Admin+ Remote Code Execution (RCE) vulnerability (CVSS 7.2)
• CVE-2024-43984 — WordPress Podlove Podcast Publisher plugin <= 4.1.13 - CSRF to Remote Code Execution (RCE) vulnerability (CVSS 8.8)
• CVE-2024-43983 — WordPress Podlove Podcast Publisher plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
• CVE-2024-32143 — WordPress Podlove Podcast Publisher plugin <= 4.1.0 - Broken Access Control vulnerability (CVSS 8.8)
• CVE-2024-32712 — WordPress Podlove Podcast Publisher plugin <= 4.0.14 - Broken Access Control vulnerability (CVSS 4.3)
• CVE-2024-32812 — WordPress Podlove Podcast Publisher plugin <= 4.0.11 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4)
• CVE-2024-32139 — WordPress Podlove Podcast Publisher plugin <= 4.0.12 - SQL Injection vulnerability (CVSS 8.8)
• CVE-2024-29915 — WordPress Podlove Podcast Publisher plugin <= 4.0.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
• CVE-2024-1110 — Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Settings Import (CVSS 5.3)
• CVE-2024-1109 — Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Unauthenticated Data Export (CVSS 5.3)
• CVE-2023-25472 — WordPress Podlove Podcast Publisher Plugin <= 3.8.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
• CVE-2023-25046 — WordPress Podlove Podcast Publisher Plugin <= 3.8.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8)