WordPress plugin
Podlove Podcast Publisher security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 29 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High8
- Medium17
- Low0
All Podlove Podcast Publisher vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook ≤4.5.6Update to 4.5.7 | CVE-2026-93775 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.5.4Update to 4.5.5 | CVE-2026-66615 | |
| High8.8 | Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter ≤4.5.3Update to 4.5.4 | CVE-2026-16099 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter ≤4.5.1Update to 4.5.2 | CVE-2026-13001 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤4.2.6Update to 4.2.7 | CVE-2025-10147 | |
| High7.2 | Authenticated (Admin+) Remote Code Execution ≤4.1.15Update to 4.1.17 | CVE-2024-52393 | |
| High8.8 | Cross-Site Request Forgery to Remote Code Execution ≤4.1.13Update to 4.1.14 | CVE-2024-43984 | |
| Critical9.9 | Authenticated (Contributor+) SQL Injection ≤4.0.12Update to 4.0.14 | CVE-2024-32139 | |
| Critical9.8 | Unauthenticated SQL Injection <3.5.6Update to 3.5.6 | CVE-2021-24666 | |
| High8.0 | Authenticated SQL Injection <2.6.0Update to 2.6.0 | CVE-2017-12949 | |
| High8.8 | SQL Injection <2.3.16Update to 2.3.16 | CVE-2016-10942 | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting <2.3.16Update to 2.3.16 | CVE-2016-10941 |
- High7.2Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook
≤4.5.6Update to 4.5.7
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.5.4Update to 4.5.5
- High8.8Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter
≤4.5.3Update to 4.5.4
- Critical9.8Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
≤4.5.1Update to 4.5.2
- Critical9.8Unauthenticated Arbitrary File Upload
≤4.2.6Update to 4.2.7
- High7.2Authenticated (Admin+) Remote Code Execution
≤4.1.15Update to 4.1.17
- High8.8Cross-Site Request Forgery to Remote Code Execution
≤4.1.13Update to 4.1.14
- Critical9.9Authenticated (Contributor+) SQL Injection
≤4.0.12Update to 4.0.14
- Critical9.8Unauthenticated SQL Injection
<3.5.6Update to 3.5.6
- High8.0Authenticated SQL Injection
<2.6.0Update to 2.6.0
- High8.8SQL Injection
<2.3.16Update to 2.3.16
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
<2.3.16Update to 2.3.16
Podlove Podcast Publisher: common questions
Does Podlove Podcast Publisher have known vulnerabilities?
Yes. VulnCrest Radar lists 29 known vulnerabilities in Podlove Podcast Publisher: 4 critical, 8 high, 17 medium. None are known to affect version null.
How do I check which version of Podlove Podcast Publisher I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Podlove Podcast Publisher vulnerability?
CVE-2026-93775, published Oct 9, 2026: Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook. Severity: High (CVSS 7.2).
Is any Podlove Podcast Publisher vulnerability listed in CISA KEV?
No. None of the known Podlove Podcast Publisher vulnerabilities is currently listed in the CISA KEV catalog.