Podlove Vulnerabilities and Affected Products - Exploit Intel

Skip to content

Products

Podlove Podcast Publisher9 vulnerabilities
podlove_podcast_publisher6 vulnerabilities
Podlove Subscribe button2 vulnerabilities
Podlove Web Player2 vulnerabilities

Podlove vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2024-52393CRITICAL	WordPress Podlove Podcast Publisher plugin <= 4.1.15 - Admin+ Remote Code Execution (RCE) vulnerability Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Podcast Publisher: from n/a through <= 4.1.15. CWE-1336 CWE-82 CWE-94Nov 14, 2024	CVSS9.1v3.1	EPSS0.518%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-43984CRITICAL	WordPress Podlove Podcast Publisher plugin <= 4.1.13 - CSRF to Remote Code Execution (RCE) vulnerability Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher allows Code Injection.This issue affects Podlove Podcast Publisher: from n/a through 4.1.13. CWE-352Oct 31, 2024	CVSS9.6v3.1	EPSS0.307%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-32143MEDIUM	WordPress Podlove Podcast Publisher plugin <= 4.1.0 - Broken Access Control vulnerability Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.1.0. CWE-862Jun 11, 2024	CVSS4.3v3.1	EPSS0.439%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-32812MEDIUM	WordPress Podlove Podcast Publisher plugin <= 4.0.11 - Server Side Request Forgery (SSRF) vulnerability Server-Side Request Forgery (SSRF) vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.11. CWE-918Apr 24, 2024	CVSS5.4v3.1	EPSS0.381%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-29915HIGH	WordPress Podlove Podcast Publisher plugin <= 4.0.9 - Reflected Cross Site Scripting (XSS) vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podlove Podlove Podcast Publisher allows Reflected XSS.This issue affects Podlove Podcast Publisher: from n/a through 4.0.9. CWE-79Mar 27, 2024	CVSS7.1v3.1	EPSS0.397%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2021-24666CRITICAL	Podlove Podcast Publisher < 3.5.6 - Unauthenticated SQL Injection The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P<id>[\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi. CWE-89Sep 27, 20211 related artifact	CVSS9.8v3.1	EPSS8.88%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX