CVE-2026-1382 describes a stored cross-site scripting vulnerability in the fresh Podcaster WordPress plugin (<=1.0.7). The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of attributes in the 'freshpodcaster' shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the affected pages. This vulnerability can lead to partial confidentiality and integrity impact but does not affect availability. No vendor advisory or patch information is currently available.

An attacker with contributor-level or higher access can inject persistent malicious scripts via the vulnerable shortcode. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to information disclosure and manipulation of content (confidentiality and integrity impacts). There is no direct impact on system availability. The vulnerability requires authentication and privileges, limiting the attack surface to authorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the fresh Podcaster plugin if feasible to mitigate risk.