Skip to content
Noroxi

Podlove Podcast Publisher

podlove-podcasting-plugin-for-wordpress · plugin

Known security vulnerabilities for Podlove Podcast Publisher. Find out in seconds which version runs on your site with WP Lens.

23 known vulnerabilities

3 critical · 13 exploitable without logging in · 2 with public exploit code · latest Sep 9, 2026

Listed on wordpress.org · latest 4.5.7 · last updated Sep 26, 2026 · 3K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2026-13001unauthenticated≤ 4.5.1

    Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

    Critical 9.8

  • CVE-2025-10147unauthenticated≤ 4.2.6

    Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Upload

    Critical 9.8

  • CVE-2016-10942unauthenticated

    The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via

    Critical 9.8

  • CVE-2024-43984unauthenticated · needs a click≤ 4.1.13

    WordPress Podlove Podcast Publisher plugin <= 4.1.13 - CSRF to Remote Code Execution (RCE) vulnerability

    High 8.8

  • CVE-2023-25472unauthenticated · needs a click≤ 3.8.3

    WordPress Podlove Podcast Publisher Plugin <= 3.8.3 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2024-32143login required≤ 4.1.0

    WordPress Podlove Podcast Publisher plugin <= 4.1.0 - Broken Access Control vulnerability

    High 8.8

  • CVE-2024-32139login required≤ 4.0.12

    WordPress Podlove Podcast Publisher plugin <= 4.0.12 - SQL Injection vulnerability

    High 8.8

  • CVE-2026-16099contributor+≤ 4.5.3

    Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter

    High 8.8

  • CVE-2024-52393admin≤ 4.1.15

    WordPress Podlove Podcast Publisher plugin <= 4.1.15 - Admin+ Remote Code Execution (RCE) vulnerability

    High 7.2

  • CVE-2026-66615unauthenticated · needs a click≤ 4.5.4

    WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-32448login required≤ 4.3.3

    WordPress Podlove Podcast Publisher plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-75966contributor+≤ 4.5.5

    Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter

    Medium 6.4

  • CVE-2024-29915unauthenticated · needs a click≤ 4.0.9

    WordPress Podlove Podcast Publisher plugin <= 4.0.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2016-10941unauthenticated · needs a click

    The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.

    Medium 6.1

  • CVE-2024-43983login required≤ 4.1.13

    WordPress Podlove Podcast Publisher plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-32812login required≤ 4.0.11

    WordPress Podlove Podcast Publisher plugin <= 4.0.11 - Server Side Request Forgery (SSRF) vulnerability

    Medium 5.4

  • CVE-2024-1110unauthenticated≤ 4.0.11

    Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Settings Import

    Medium 5.3

  • CVE-2024-1109unauthenticated≤ 4.0.11

    Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Unauthenticated Data Export

    Medium 5.3

  • CVE-2023-25046admin≤ 3.8.2

    WordPress Podlove Podcast Publisher Plugin <= 3.8.2 is vulnerable to Cross Site Scripting (XSS)

    Medium 4.8

  • CVE-2025-58204unauthenticated · needs a click≤ 4.2.5

    WordPress Podlove Podcast Publisher Plugin <= 4.2.5 - Open Redirection Vulnerability

    Medium 4.7

  • CVE-2025-1383unauthenticated · needs a click≤ 4.2.2

    Podlove Podcast Publisher <= 4.2.2 - Cross-Site Request Forgery via ajax_transcript_delete Function

    Medium 4.3

  • CVE-2024-32712unauthenticated≤ 4.0.14

    WordPress Podlove Podcast Publisher plugin <= 4.0.14 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2025-0554admin≤ 4.1.25

    Podlove Podcast Publisher <= 4.1.25 - Authenticated (Admin+) Stored Cross-Site Scripting via Feed Name

    Medium 4.0

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory