The Podlove Podcast Publisher plugin for WordPress versions up to 4.1.25 contains a stored cross-site scripting vulnerability (CWE-79) via the Feed Name field. Authenticated users with administrator privileges can inject arbitrary web scripts due to inadequate input sanitization and output escaping. This vulnerability specifically impacts multi-site WordPress setups or installations where the unfiltered_html capability is disabled, enabling persistent script execution when affected pages are viewed. The CVSS 3.1 base score is 4.4, reflecting a network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with administrator-level access on affected WordPress multi-site installations or sites with unfiltered_html disabled can inject malicious scripts that execute in the context of users visiting the injected pages. This can lead to partial compromise of confidentiality and integrity of the affected site or user data. There is no impact on availability. No known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit administrator access to trusted users only and consider disabling or restricting the use of the Feed Name field in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once available.