Threats tagged 'ghsa-x69j-9g3m-g638'

The Podlove Podcast Publisher WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability via the Auphonic webhook endpoint in all versions up to and including 4.5.6. This vulnerability allows unauthenticated attackers to inject arbitrary scripts by submitting a crafted POST request where the status_string field is not 'Done'. The injected scripts execute when a user accesses the affected page, potentially leading to session hijacking or other malicious actions.