CVE-2026-66615: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Eric Teubert Podlove Podcast Publisher

CVE-2026-66615 is an unauthenticated cross-site scripting (XSS) vulnerability classified under CWE-79 in the Podlove Podcast Publisher software by Eric Teubert. It affects all versions up to and including 4.5.4. The vulnerability arises from improper neutralization of input during web page generation, enabling attackers to inject and execute arbitrary scripts in the context of the victim's browser. The CVSS 3.1 score is 7.1 (high), with attack vector network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), scope changed (S:C), and impacts on confidentiality, integrity, and availability (C:L/I:L/A:L). No patch or remediation information is provided in the source data.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in data theft, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The vulnerability is exploitable remotely without authentication but requires user interaction to trigger.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying temporary mitigations such as input validation or output encoding if feasible. Monitor vendor channels for updates and apply patches promptly once released.