4.3
Medium
CVE-2026-13729 The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its…
Description
The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Podlove Podcast Publisher 4.5 | earliest → < 4.5.3 | 4.5.3 |
Other CVEs of Podlove Podcast Publisher
The 4 CVEs of Podlove Podcast Publisher →
CVE-2024-13729
The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which…
4.8
Medium
CVE-2024-13730
The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which…
4.8
Medium
CVE-2021-24666
The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by…
Not rated