Podlove Podcast Publisher
Moderate fix1 remedy
cpe:2.3:a:podlove:podlove_podcast_publisher:*:*:*:*:wordpress:*:*
Moderate fix1 remedy
- <= 4.2.2
Podlove Podcast Publisher Cross-Site Request Forgery Vulnerability in WordPress
Vulnerability
Patched
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Podlove Podcast Publisher plugin for WordPress, affecting all versions through 4.2.2. The issue arises from inadequate nonce validation in the 'ajax_transcript_delete()' function, allowing unauthenticated attackers to delete episode transcripts by tricking an administrator into clicking a link.
Impact
Exploitation of this vulnerability allows for Cross-Site Request Forgery, enabling the deletion of arbitrary episode transcripts.
Remediation
Users can update to Podlove Podcast Publisher version 4.2.3 or later to address this vulnerability.
Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM
Vulnerability Rating
Custom Algorithm
spread
3.4impact
0.6exploitability
7.2remediation
7.7relevance
0.0threat
3.2urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.