CVE-2026-1382: Fresh Podcaster WordPress XSS Vulnerability

CVE-2026-1382 Overview

CVE-2026-1382 is a stored Cross-Site Scripting (XSS) vulnerability in the Fresh Podcaster plugin for WordPress. The flaw affects all versions up to and including 1.0.7. The plugin fails to sanitize input and escape output on user-supplied attributes passed to the freshpodcaster shortcode. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who loads the affected page. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can persist arbitrary JavaScript into published pages, enabling session theft, credential harvesting, and administrative account takeover when higher-privileged users view the affected content.

Affected Products

Fresh Podcaster plugin for WordPress — all versions through 1.0.7
WordPress sites permitting contributor-level or higher registration
Sites rendering content via the freshpodcaster shortcode

Discovery Timeline

2026-07-11 - CVE-2026-1382 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-1382

Vulnerability Analysis

The vulnerability resides in the Fresh Podcaster plugin's shortcode handler. The freshpodcaster shortcode accepts user-supplied attributes and passes them to the public display template without sufficient sanitization or output escaping. The affected rendering logic is located in public/partials/fresh-podcaster-public-display.php at line 25, and the shortcode registration lives in public/class-fresh-podcaster-shortcodes.php at line 73. When a contributor or higher-privileged user embeds the shortcode with crafted attribute values, the raw payload is emitted into the page HTML. Any visitor who subsequently loads the page executes the attacker-controlled script in the context of the WordPress site's origin.

Root Cause

The root cause is missing input sanitization on shortcode attributes combined with the absence of output escaping functions such as esc_attr() or esc_html() when rendering those attributes. WordPress provides these helpers precisely to neutralize shortcode-derived data before it reaches the DOM, but they are not applied in the vulnerable code paths.

Attack Vector

An authenticated contributor authors a post containing the freshpodcaster shortcode with a malicious attribute value carrying JavaScript. After the post is published or previewed by a reviewer, the injected script executes in the browser of every visitor. Impact scales with the privilege of the viewer: sessions of editors and administrators can be hijacked, allowing account takeover and further site compromise. The vulnerability requires contributor-level authentication but no user interaction beyond viewing the page.

Refer to the Wordfence Vulnerability Report and the Fresh Podcaster shortcode source for the affected code paths.

Detection Methods for CVE-2026-1382

Indicators of Compromise

Post or page content containing [freshpodcaster ...] shortcodes with attribute values including <script>, onerror=, onload=, or javascript: substrings.
Unexpected outbound HTTP requests from browsers viewing WordPress content, particularly to attacker-controlled domains carrying cookies or form data.
New or modified administrator accounts created shortly after contributor activity on posts using the plugin.
Contributor accounts submitting or editing posts at unusual hours or from atypical IP addresses.

Detection Strategies

Query the WordPress wp_posts table for post_content matching the freshpodcaster shortcode combined with HTML event handler or <script> patterns.
Review web server access logs for POST requests to wp-admin/post.php or wp-admin/admin-ajax.php from contributor accounts that include script-like payloads.
Deploy Content Security Policy (CSP) reporting to surface inline script violations originating from rendered plugin content.

Monitoring Recommendations

Alert on creation, deletion, or role changes of WordPress administrator accounts.
Monitor plugin installation and version state, flagging any Fresh Podcaster instance at or below version 1.0.7.
Track authentication events for contributor and editor roles and correlate with post publication activity.

How to Mitigate CVE-2026-1382

Immediate Actions Required

Update the Fresh Podcaster plugin to a patched release above 1.0.7 as soon as one is published by the vendor.
If no patched version is available, deactivate and remove the Fresh Podcaster plugin from all affected WordPress installations.
Audit existing posts and pages for the freshpodcaster shortcode and inspect attribute values for injected script content.
Review contributor and author accounts, rotating credentials for any suspicious users and enforcing multi-factor authentication.

Patch Information

At the time of publication, the NVD entry for CVE-2026-1382 does not reference a fixed release. Consult the Wordfence Vulnerability Report and the WordPress plugin repository for updated version availability.

Workarounds

Restrict contributor and author role assignments to trusted users only, and disable open registration for these roles.
Deploy a Web Application Firewall (WAF) rule that inspects shortcode attribute values submitted via wp-admin requests and blocks script-like payloads.
Implement a strict Content Security Policy that disallows inline scripts and untrusted origins to limit exploitability of stored XSS.
Require editorial review of all contributor submissions before publication and preview by higher-privileged users.

bash

# Example: disable the Fresh Podcaster plugin via WP-CLI until a fix is released
wp plugin deactivate fresh-podcaster
wp plugin delete fresh-podcaster

# Example: search post content for the vulnerable shortcode
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[freshpodcaster%';"