WordPress plugin
Podlove Podcast Publisher security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 29 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High8
- Medium17
- Low0
All Podlove Podcast Publisher vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook
≤4.5.6Update to 4.5.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter
≤4.5.5Update to 4.5.6
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.5.4Update to 4.5.5
- High8.8Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter
≤4.5.3Update to 4.5.4
- Medium4.3Cross-Site Request Forgery
<4.5.3Update to 4.5.3
- Critical9.8Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
≤4.5.1Update to 4.5.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.3.3Update to 4.3.4
- Critical9.8Unauthenticated Arbitrary File Upload
≤4.2.6Update to 4.2.7
- Medium6.1Open Redirect
≤4.2.5Update to 4.2.6
- Medium4.3Cross-Site Request Forgery via ajax_transcript_delete Function
≤4.2.2Update to 4.2.3
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.1.23Update to 4.1.24
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.2.0Update to 4.2.1
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Feed Name
≤4.1.25Update to 4.2.0
- High7.2Authenticated (Admin+) Remote Code Execution
≤4.1.15Update to 4.1.17
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.1.13Update to 4.1.14
- High8.8Cross-Site Request Forgery to Remote Code Execution
≤4.1.13Update to 4.1.14
- Medium4.3Cross-Site Request Forgery
≤4.0.14Update to 4.0.15
- Medium4.3Authenticated (Contributor+) Server-Side Request Forgery
≤4.0.11Update to 4.0.12
- Critical9.9Authenticated (Contributor+) SQL Injection
≤4.0.12Update to 4.0.14
- Medium4.3Missing Authorization
≤4.1.0Update to 4.1.1
- Medium6.1Reflected Cross-Site Scripting
≤4.0.9Update to 4.0.10
- Medium5.3Missing Authorization to Settings Import
≤4.0.11Update to 4.0.12
- Medium5.3Missing Authorization to Unauthenticated Data Export
≤4.0.11Update to 4.0.12
- Medium4.3Cross-Site Request Forgery
≤3.8.3Update to 3.8.4
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.8.2Update to 3.8.3
- Critical9.8Unauthenticated SQL Injection
<3.5.6Update to 3.5.6
- High8.0Authenticated SQL Injection
<2.6.0Update to 2.6.0
- High8.8SQL Injection
<2.3.16Update to 2.3.16
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
<2.3.16Update to 2.3.16
Podlove Podcast Publisher: common questions
Does Podlove Podcast Publisher have known vulnerabilities?
Yes. VulnCrest Radar lists 29 known vulnerabilities in Podlove Podcast Publisher: 4 critical, 8 high, 17 medium. None are known to affect version null.
How do I check which version of Podlove Podcast Publisher I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Podlove Podcast Publisher vulnerability?
CVE-2026-93775, published Oct 9, 2026: Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook. Severity: High (CVSS 7.2).
Is any Podlove Podcast Publisher vulnerability listed in CISA KEV?
No. None of the known Podlove Podcast Publisher vulnerabilities is currently listed in the CISA KEV catalog.