CVE-2026-66615 is an unauthenticated cross-site scripting (XSS) vulnerability in Eric Teubert's Podlove Podcast Publisher affecting versions up to 4.5.4. The flaw arises from improper neutralization of input during web page generation, classified under CWE-79. The vulnerability allows remote attackers to inject malicious scripts without authentication, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No patch or official remediation level has been published as of the data provided.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal user data, hijack user sessions, or perform actions with the privileges of the victim user. The vulnerability affects confidentiality, integrity, and availability to a limited extent. Since the vulnerability is unauthenticated and remotely exploitable with low complexity, it poses a significant risk to users of affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds or temporary mitigations recommended by the vendor. Monitoring vendor channels for updates is advised.