PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-93775 eteubert CVE debrief

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, which can execute on pages accessed by users. Defenders should prioritize verifying exposure and applying patches or updates to prevent exploitation. The CVE record and source item provide details on the vulnerability, including the affected versions and the lack of authentication required for exploitation.

Vendor
eteubert
Product
Podlove Podcast Publisher
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-10
Original CVE updated
2026-10-10
Advisory published
2026-10-10
Advisory updated
2026-10-10

Who should care

Defenders responsible for WordPress installations with the Podlove Podcast Publisher plugin should assess exposure and apply patches or updates to prevent exploitation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to prioritize verifying exposure and applying patches for Podlove Podcast Publisher versions up to 4.5.6.

Why it matters

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook, allowing unauthenticated attackers to inject arbitrary web scripts. Defenders should prioritize verifying exposure and applying patches or updates to prevent exploitation.

  • Unauthenticated attackers can inject arbitrary web scripts
  • Injected scripts can execute on pages accessed by users
  • Defenders must verify exposure and apply patches or updates
  • Additional security measures may be necessary to prevent exploitation

Technical summary

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injection is triggered by submitting a request to the Auphonic webhook endpoint with any POST body where the status_string field is not the literal string 'Done', causing the full raw POST superglobal to be stored in the plugin log

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Podlove Podcast Publisher versions up to 4.5.6.

Recommended defensive actions

  • Verify exposure of Podlove Podcast Publisher versions up to 4.5.6
  • Apply patches or updates to Podlove Podcast Publisher
  • Monitor for suspicious activity on affected systems
  • Implement additional security measures to prevent exploitation
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected versions and the lack of authentication required for exploitation. Evidence limits are noted based on available information. Defenders should verify the exposure of Podlove Podcast Publisher versions up to 4.5.6. The injection is triggered by submitting a request to the Auphonic webhook endpoint with any POST body where the status_string field is not the literal string 'Done', causing the full raw POST superglobal to be stored in the plugin log

Sources and references

Verified primary and authoritative sources

  • CVE-2026-93775 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-93775

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-93775 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-93775

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic We

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93775.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.6/lib/modules/logging/logging.php

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.6/lib/modules/auphonic/auphonic.php

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/podlove/podlove-publisher/commit/c716e3d92e4b2c69bf8c5cd985bbeab6950f0cfa

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/changeset/3713919/podlove-podcasting-plugin-for-wordpress/trunk/lib/modules/logging/logging.php

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.