CVE-2021-47968: Podcast Generator 3.1 XSS Vulnerability

CVE-2021-47968 Overview

CVE-2021-47968 is a stored cross-site scripting (XSS) vulnerability in Podcast Generator 3.1, an open-source PHP application for podcast publishing. The flaw resides in the long_description parameter used when creating or editing podcast episodes. Authenticated attackers can submit unfiltered JavaScript that the application persists in episode metadata and renders to every visitor who opens the affected episode page. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation and was published to the National Vulnerability Database on 2026-05-15.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in the browsers of users viewing podcast episode details, enabling session theft, account takeover, and phishing.

Affected Products

• Podcast Generator 3.1
• Earlier 3.x branches sharing the same long_description handling code
• Self-hosted deployments of Podcast Generator distributed from podcastgenerator.net

Discovery Timeline

• 2026-05-15 - CVE-2021-47968 published to NVD
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2021-47968

Vulnerability Analysis

Podcast Generator 3.1 accepts user-supplied episode metadata through the administrative web interface. The long_description field is intended to hold a multi-line text description of an episode. The application fails to neutralize HTML control characters and <script> tags before storing the value, and it also fails to encode the value when rendering it on the public episode detail view. As a result, any payload submitted through episode creation or editing requests becomes part of the page DOM for every subsequent visitor. The attacker requires only an authenticated session capable of editing episodes, which lowers the barrier for malicious insiders or compromised contributor accounts.

Root Cause

The root cause is missing output encoding on the long_description value in episode rendering templates, combined with absent server-side input sanitization on the episode submission handler. Both the storage path and the presentation path trust raw user input, satisfying the conditions for stored XSS [CWE-79].

Attack Vector

An authenticated attacker submits an episode creation or edit request and places a JavaScript payload inside the long_description form field. The server persists the payload to the episode database or XML store. When any user (including unauthenticated visitors and higher-privileged administrators) loads the episode details page, the browser parses the injected <script> element and executes attacker-controlled code in the application's origin. Refer to the VulnCheck Advisory on Podcast Generator and Exploit-DB #49866 for the proof-of-concept request and payload structure.

Detection Methods for CVE-2021-47968

Indicators of Compromise

• Episode records containing <script>, onerror=, onload=, or javascript: sequences within the long_description field.
• HTTP POST requests to episode submission endpoints carrying encoded angle brackets or event-handler attributes in the long_description parameter.
• Unexpected outbound requests from visitor browsers to attacker-controlled domains shortly after viewing episode pages.

Detection Strategies

• Inspect stored episode metadata (database rows and XML files under the Podcast Generator data directory) for HTML or JavaScript tokens that should not appear in plain-text descriptions.
• Deploy web application firewall rules that flag XSS signatures on POST parameters submitted to the Podcast Generator administrative routes.
• Enable Content Security Policy (CSP) violation reporting to surface inline script execution originating from episode pages.

Monitoring Recommendations

• Monitor authentication and audit logs for episode edits performed by low-privilege or recently created accounts.
• Alert on anomalous request bodies that exceed expected length or contain HTML entities in description fields.
• Track referrer headers and DOM-based telemetry for users redirected from episode pages to unknown external hosts.

How to Mitigate CVE-2021-47968

Immediate Actions Required

• Restrict episode creation and editing privileges to trusted administrators until a patched build is deployed.
• Audit existing episodes and remove or sanitize any long_description content containing HTML or script tokens.
• Place the Podcast Generator administrative interface behind network controls or VPN access to reduce exposure of the authenticated attack surface.

Patch Information

No vendor patch is referenced in the CVE record at publication. Administrators should consult the Podcast Generator Download page for releases newer than 3.1 and apply the latest available version. If running an unmaintained instance, apply the workarounds below or migrate to a maintained alternative.

Workarounds

• Add server-side sanitization (for example, HTMLPurifier) to strip tags from long_description before persistence.
• Apply output encoding in episode rendering templates so stored values are emitted as text rather than HTML.
• Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources on episode pages.
• Require multi-factor authentication for any account permitted to publish or edit episodes.

# Example CSP response header to block inline script execution on episode pages
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";