Extension WordPress
Vulnérabilités Podlove Podcast Publisher
Cette page rassemble les failles publiées pour Podlove Podcast Publisher, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Podlove Podcast Publisher
24 fiches
Podlove Podcast Publisher <= 4.5.1 – Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers…
*-4.5.1
4.5.2
14/07/2026
Podlove Podcast Publisher <= 4.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access…
*-4.3.3
4.3.4
08/03/2026
Podlove Podcast Publisher <= 4.2.6 – Unauthenticated Arbitrary File Upload
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_as_original_file' function in all versions up to, and including, 4.2.6. This makes it possible for unauthenticated attackers…
*-4.2.6
4.2.7
22/09/2025
Podlove Podcast Publisher <= 4.2.5 – Open Redirect
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 4.2.5. This is due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers…
*-4.2.5
4.2.6
27/08/2025
Podlove Podcast Publisher <= 4.2.2 – Cross-Site Request Forgery via ajax_transcript_delete Function
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. This is due to missing or incorrect nonce validation on the ajax_transcript_delete() function. This makes it possible…
*-4.2.2
4.2.3
05/03/2025
Podlove Podcast Publisher <= 4.2.0 – Authenticated (Admin+) Stored Cross-Site Scripting
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
*-4.2.0
4.2.1
03/03/2025
Podlove Podcast Publisher <= 4.1.23 – Authenticated (Admin+) Stored Cross-Site Scripting
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
*-4.1.23
4.1.24
03/03/2025
Podlove Podcast Publisher <= 4.1.25 – Authenticated (Admin+) Stored Cross-Site Scripting via Feed Name
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version
*-4.1.25
4.2.0
17/01/2025
Podlove Podcast Publisher <= 4.1.15 – Authenticated (Admin+) Remote Code Execution
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.15. This makes it possible for authenticated attackers, with administrator-level access and above, to execute code on the…
*-4.1.15
4.1.17
11/11/2024
Podlove Podcast Publisher <= 4.1.13 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.1.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access…
*-4.1.13
4.1.14
28/08/2024
Podlove Podcast Publisher <= 4.1.13 – Cross-Site Request Forgery to Remote Code Execution
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.1.13. This is due to missing or incorrect nonce validation on the 'get', 'update', 'create', and 'delete' functions. This…
*-4.1.13
4.1.14
28/08/2024
Podlove Podcast Publisher <= 4.0.14 – Cross-Site Request Forgery
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.14. This is due to missing or incorrect nonce validation on the job_create() and job_delete() functions. This makes…
*-4.0.14
4.0.15
22/04/2024
Podlove Podcast Publisher <= 4.0.11 – Authenticated (Contributor+) Server-Side Request Forgery
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.11 via the fetch_url_meta function. This makes it possible for authenticated attackers, with contributor-level access and above, to…
*-4.0.11
4.0.12
22/04/2024
Podlove Podcast Publisher <= 4.0.12 – Authenticated (Contributor+) SQL Injection
The Podlove Podcast Publisher plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.…
*-4.0.12
4.0.14
12/04/2024
Podlove Podcast Publisher <= 4.1.0 – Missing Authorization
The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions such as do_repair() in versions up to, and including, 4.1.0. This makes it possible for authenticated attackers,…
*-4.1.0
4.1.1
12/04/2024
Podlove Podcast Publisher <= 4.0.9 – Reflected Cross-Site Scripting
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…
*-4.0.9
4.0.10
25/03/2024
Podlove Podcast Publisher <= 4.0.11 – Missing Authorization to Unauthenticated Data Export
The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_download() and init() functions in all versions up to, and including, 4.0.11. This makes it possible…
*-4.0.11
4.0.12
06/02/2024
Podlove Podcast Publisher <= 4.0.11 – Missing Authorization to Settings Import
The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated…
*-4.0.11
4.0.12
06/02/2024
Podlove Podcast Publisher <= 3.8.3 – Cross-Site Request Forgery
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.8.3. This is due to missing nonce validation on multiple functions. This makes it possible for unauthenticated attackers to…
*-3.8.3
3.8.4
10/02/2023
Podlove Podcast Publisher <= 3.8.2 – Authenticated (Admin+) Stored Cross-Site Scripting
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unspecified parameters (but including plugin options such as 'subtitle' and 'summary' fields) in versions up to, and including, 3.8.2 due to insufficient input sanitization…
*-3.8.2
3.8.3
03/02/2023
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.