PodcastGenerator Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in PodcastGenerator version 3.2.9. This issue resides in the Freebox content field, which is accessible through the theme customization interface. Malicious JavaScript payloads injected into this field are executed when users visit the application's home page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, navigate to the 'Themes and aspect' section and select 'Customize your Freebox'. Inject a script payload into the Freebox content field and save the changes. The injected script will execute when the home page is visited.