CVE-2026-93775 in Podlove Podcast Publisher Plugin
Summary
by MITRE • 10/10/2026
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injection is triggered by submitting a request to the Auphonic webhook endpoint with any POST body where the status_string field is not the literal string 'Done', causing the full raw POST superglobal to be stored in the plugin log before any authentication key validation is performed.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The Podlove Podcast Publisher, a widely utilized WordPress plugin for managing and distributing podcast content, contains a critical security flaw affecting all versions up through 4.5.6. This vulnerability manifests as a Stored Cross-Site Scripting (XSS) issue rooted in the integration with Auphonic, an automated audio post-production service. The core of the problem lies in how the plugin handles incoming webhook requests from this external service. Specifically, the application fails to implement adequate input sanitization and output escaping mechanisms when processing data received via the Auphonic Webhook endpoint. This architectural oversight allows malicious actors to inject arbitrary web scripts into the system's stored data, which are subsequently executed whenever a user views pages containing these injected payloads.
The technical mechanism of this vulnerability is particularly insidious due to its unauthenticated nature and the specific conditions required for exploitation. An attacker can trigger the injection by sending an HTTP POST request to the Auphonic webhook endpoint with any body content where the status_string field does not exactly match the literal string 'Done'. Under these circumstances, the plugin logs the full raw POST superglobal data into its internal log files before performing any authentication key validation. This sequence of operations is critical because it means that even if an attacker lacks valid credentials or a legitimate API key for the webhook endpoint, they can still successfully write malicious content to the server's storage. The lack of early-stage input filtering ensures that raw user-controlled data enters the system without scrutiny, leading directly to persistent code injection within the application logs and potentially other stored contexts depending on how those logs are rendered in the admin interface or elsewhere.
From an operational impact perspective, this vulnerability poses a severe risk to both website administrators and end-users who access the WordPress dashboard or any area where the plugin's data is displayed. Because the XSS payload is stored server-side rather than being confined to a single session via URL parameters, it persists across multiple user interactions. When an administrator or authorized user views logs or reports that include this tainted data without proper escaping, the malicious JavaScript executes in their browser context. This can lead to complete compromise of the administrative account through session hijacking, credential theft, or unauthorized actions performed under the victim's privileges. Furthermore, since the attack vector is unauthenticated, it does not require prior access to the WordPress installation, making it a significant threat for any publicly accessible endpoint that exposes this webhook functionality.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as Cross-site Scripting. The specific behavior of logging raw POST data without validation also reflects weaknesses in input handling and error management often associated with insufficient sanitization practices. In the context of the MITRE ATT&CK framework for enterprise security, this flaw facilitates initial access and potential privilege escalation through stored XSS techniques. Attackers can leverage this to execute scripts within the trusted domain of the WordPress site, bypassing same-origin policy restrictions that typically limit malicious script execution. The ability to inject code without authentication further exacerbates the risk by lowering the barrier to entry for opportunistic attackers scanning for vulnerable plugins.
To mitigate this vulnerability, immediate action is required from system administrators and developers using Podlove Podcast Publisher. The primary remediation step is to upgrade the plugin to version 4.5.7 or later, where these input sanitization and output escaping issues have been addressed by the maintainers. Until an update can be applied, organizations should consider restricting access to the Auphonic webhook endpoint via firewall rules or web application firewalls that validate incoming requests against expected parameters before they reach the PHP execution environment. Additionally, implementing strict Content Security Policy headers can help mitigate the impact of any successfully injected scripts by preventing unauthorized script execution in the browser context. Regular security audits and code reviews focusing on how external data is handled and rendered are essential to prevent similar vulnerabilities from being introduced or persisting in WordPress ecosystems.