The vulnerability CVE-2026-24952 affects the Seriously Simple Podcasting plugin for WordPress, allowing stored cross-site scripting due to improper input sanitization during web page generation. This can enable attackers with low privileges to inject malicious scripts that execute when other users view the affected pages. The vulnerability impacts versions up to 3.14.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and impacts confidentiality, integrity, and availability at a low level. No patch or official fix information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to session hijacking, information disclosure, or other impacts on confidentiality, integrity, and availability. The impact is rated medium severity with a CVSS score of 6.5. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting plugin usage to trusted users and limit exposure to untrusted input. Monitor official channels for updates or patches addressing this vulnerability.