castos Vulnerabilities and Affected Products
Vulnerabilities associated with seriously_simple_podcasting.
Products
Clear product- seriously_simple_podcasting3 vulnerabilities
- Seriously Simple Stats2 vulnerabilities
- Seriously Simple Podcasting (WordPress plugin)1 vulnerability
- seriously_simple_stats1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-3751MEDIUM | Seriously Simple Podcasting < 3.3.0 - Admin+ Stored XSSThe Seriously Simple Podcasting WordPress plugin before 3.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) CWE-79Jul 13, 2024 | CVSS4.8v3.1 | EPSS0.455% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-25599HIGH | WordPress Seriously Simple Podcasting plugin <= 3.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting.This issue affects Seriously Simple Podcasting: from n/a through <= 3.0.2. CWE-79Mar 28, 2024 | CVSS7.1v3.1 | EPSS0.426% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-6444MEDIUM | Seriously Simple Podcasting < 3.0.0 - Unauthenticated Administrator Email DisclosureThe Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request. | CVSS5.3v3.1 | EPSS2.46% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |