CVE-2026-75966: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in eteubert Podlove Podcast Publisher

CVE-2026-75966 is a stored cross-site scripting vulnerability (CWE-79) in the Podlove Podcast Publisher WordPress plugin. It affects all versions up to and including 4.5.5. The flaw exists because the 'episode_contributor[..][..][comment]' parameter is not properly sanitized or escaped before being stored and displayed. The contributor comments are saved in a plugin-specific custom table, which bypasses the WordPress core's wp_kses_post filter. Furthermore, the save_post hook that processes these inputs does not implement a nonce check, enabling any user with post editing permissions (contributor level or higher) to inject arbitrary JavaScript code. This code executes in the context of users viewing the injected pages, potentially leading to session hijacking or other client-side attacks. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with contributor-level or higher privileges can inject malicious scripts into podcast episode contributor comments. These scripts execute in the browsers of users who view the affected pages, potentially leading to theft of sensitive information or session tokens. The vulnerability does not affect availability. Because the save_post hook lacks nonce verification, exploitation requires only the ability to edit posts, which is common for contributors and above. This elevates the risk of persistent XSS attacks within affected WordPress sites using this plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only. Monitor plugin updates from the vendor for a security patch addressing this issue. Avoid using the vulnerable parameter or disable the Podlove Podcast Publisher plugin if possible. Implement additional web application firewall (WAF) rules to detect and block suspicious input patterns related to this parameter.