CVE-2026-75966: Podlove Podcast Publisher XSS Vulnerability

CVE-2026-75966 Overview

CVE-2026-75966 is a Stored Cross-Site Scripting (XSS) vulnerability in the Podlove Podcast Publisher plugin for WordPress. The flaw affects all versions up to and including 4.5.5. It resides in the episode_contributor[..][..][comment] parameter, which lacks proper input sanitization and output escaping [CWE-79]. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript that executes when any user views the affected page. The contributor comment is written to a plugin-managed custom database table, which bypasses the standard WordPress wp_kses_post filter applied to core post content.

Critical Impact
A contributor-level user can plant persistent JavaScript that runs in the browser of any visitor or administrator viewing the injected content, enabling session theft, forced administrative actions, and site takeover chains.

Affected Products

Podlove Podcast Publisher plugin for WordPress, versions ≤ 4.5.5
WordPress sites accepting contributor-level registrations
WordPress installations using Podlove Twig templates for contributor rendering

Discovery Timeline

2026-09-09 - CVE-2026-75966 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-75966

Vulnerability Analysis

The vulnerability is a classic Stored XSS caused by two compounding weaknesses in the plugin's contributor module. First, the save_post hook that persists the episode_contributor[..][..][comment] value does not enforce a nonce check, so any user session capable of editing posts can submit the payload without CSRF protection. Second, the value is written into a plugin-owned custom table rather than into a WordPress post field, so WordPress core's wp_kses_post sanitization never runs against the input.

When the contributor list is rendered through the plugin's Twig template contributor-table.twig, the comment field is emitted through a Twig filter that does not apply strict HTML escaping. The injected script therefore executes in the browser of every visitor who loads the affected page, including administrators reviewing episode metadata.

Exploitation is remotely reachable over the network, requires low-privilege authentication, and needs no user interaction to trigger once the payload is stored. Because the payload runs in the origin of the WordPress site, it can be chained to hijack administrator sessions and perform privileged actions.

Root Cause

The root cause is missing input sanitization at write time and missing output escaping at render time for the contributor comment field. The plugin trusts contributor-supplied HTML because its persistence path avoids WordPress's post-content filtering pipeline, and its Twig rendering path emits the value without HTML entity encoding. The absence of a nonce on the save_post handler removes a secondary control that would otherwise limit blind cross-site abuse.

Attack Vector

A contributor authenticates to WordPress and edits or creates a post that exposes the Podlove episode metadata interface. The attacker submits an episode_contributor[..][..][comment] value containing an HTML <script> tag or an event-handler attribute payload. The plugin stores the raw string in its custom contributors table. When any user later loads a page that renders the contributor table through the Twig template, the browser parses the injected markup and executes the attacker-controlled script in the site's origin.

See the Wordfence Vulnerability Analysis and the affected Podlove Twig Filter code for the exact sink location.

Detection Methods for CVE-2026-75966

Indicators of Compromise

Unexpected <script>, <img onerror=...>, or javascript: strings in the Podlove contributors custom database table comment column.
Contributor-role accounts creating or editing episodes shortly after registration.
Outbound requests from administrator browsers to unfamiliar domains immediately after loading a page containing a Podlove contributor table.
New administrator accounts or altered user roles that correlate with contributor activity on Podlove-enabled posts.

Detection Strategies

Query the plugin's contributors table for rows whose comment field contains <, >, on\w+=, or javascript: substrings.
Enable WordPress audit logging to record every save_post event tied to the Podlove episode contributor meta box.
Deploy a Content Security Policy in report-only mode and alert on inline-script violations originating from Podlove-rendered pages.

Monitoring Recommendations

Monitor authentication logs for contributor-role accounts followed by rapid post-edit activity on episode content.
Track administrator session anomalies such as new API tokens, plugin installations, or theme edits after viewing episode pages.
Alert on modifications to wp_users, wp_usermeta, and wp_options that occur in the same session as a Podlove page view.

How to Mitigate CVE-2026-75966

Immediate Actions Required

Update the Podlove Podcast Publisher plugin to the version published after 4.5.5 that includes the fix from the Podlove Plugin Changeset Update.
Audit contributor-role and higher accounts and remove any that are unrecognized or inactive.
Inspect the Podlove contributors table for previously stored payloads and sanitize or delete affected rows.

Patch Information

The vulnerability is present in all versions of the Podlove Podcast Publisher plugin up to and including 4.5.5. Site administrators should upgrade to the fixed release referenced in the plugin's WordPress.org changeset. Review the updated contributor handler code and the contributor table template to confirm the fix in your deployment.

Workarounds

Temporarily restrict contributor and author roles from editing posts that use Podlove episode metadata until patching is complete.
Deploy a web application firewall rule that blocks POST bodies containing episode_contributor parameters with HTML tag or event-handler patterns.
Enforce a strict Content Security Policy that disallows inline scripts on the front-end and WordPress admin pages rendering Podlove templates.

bash

# Configuration example: WordPress CLI update and role review
wp plugin update podlove-podcasting-plugin-for-wordpress
wp user list --role=contributor --fields=ID,user_login,user_registered,user_email