PodcastGenerator 3.2.9 - Stored XSS
Source Exploit-DB RSS Feed
Not known to be exploited · public exploit available (Exploit-DB) · CVSS 4.8 Medium.
Data as of 10/25/2026, 04:40:11 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 46% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Public exploits
- 1 Exploit-DB entryPublic attack or detection tooling exists; see Public exploits below.
What to do
AI-suggested
Until a fix is available, restrict administrator access to trusted users only and consider sanitizing or filtering input fields in the Live Items functionality to prevent script injection. Monitor updates from the PodcastGenerator project for a security update addressing this issue.
Public exploits and detection
Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.
Description
PodcastGenerator version 3.2.9 contains a stored Cross-Site Scripting (XSS) vulnerability in its Live Items functionality. An authenticated administrator can inject malicious JavaScript code into the TITLE, SHORT DESCRIPTION, or LONG DESCRIPTION fields of a Live Item. This payload is stored and executed when the Live Item is viewed both in the administrative interface and on the public Live Stream page. While administrative privileges are required to inject the payload, any unauthenticated user visiting the public Live Stream page can trigger the stored script execution.
Impact
The vulnerability allows an authenticated administrator to inject malicious scripts that execute in the browsers of both administrators and public visitors. This can lead to session hijacking, defacement, or other client-side attacks against users viewing the affected pages. Since unauthenticated users can trigger the stored payload on the public Live Stream page, the attack surface extends beyond administrators to all visitors. However, exploitation requires initial administrator access to inject the payload.
Summary
PodcastGenerator 3.2.9 is affected by a stored XSS vulnerability (CVE-2025-70336) in the Live Items feature. An attacker with administrator access can inject JavaScript code via the TITLE, SHORT DESCRIPTION, or LONG DESCRIPTION parameters of a Live Item. The malicious script is stored persistently and executed when the Live Item is rendered in the admin Live Items listing and on the public Live Stream page. This allows unauthenticated users to be exposed to the malicious script when visiting the public page. The exploit was demonstrated on Windows 11 with XAMPP. No vendor patch or official fix information is provided in the data.
Indicators of compromise
Exploit source code
# Exploit Title: PodcastGenerator 3.2.9 - Stored XSS
# Date: 2026-08-08
# Exploit Author: Sahil Arya
# Vendor Homepage: https://github.com/PodcastGenerator/PodcastGenerator
# Software Link: https://github.com/PodcastGenerator/PodcastGenerator
# Version: 3.2.9
# Tested on: Windows 11 / XAMPP
# CVE : CVE-2025-70336
Description:
PodcastGenerator 3.2.9 contains a stored Cross-Site Scripting
vulnerability in the Live Items functionality.
An authenticated administrator can inject JavaScript through…