Vulnerabilities > Podlove

DATE CVE VULNERABILITY TITLE RISK
2024-09-18 CVE-2024-43983 Cross-site Scripting vulnerability in Podlove Podcast Publisher
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Podlove Podlove Podcast Publisher allows Stored XSS.This issue affects Podlove Podcast Publisher: from n/a through 4.1.13.
network
low complexity
podlove CWE-79
5.4
2024-02-07 CVE-2024-1109 Missing Authorization vulnerability in Podlove Podcast Publisher
The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_download() and init() functions in all versions up to, and including, 4.0.11.
network
low complexity
podlove CWE-862
5.3
2024-02-07 CVE-2024-1110 Missing Authorization vulnerability in Podlove Podcast Publisher
The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11.
network
low complexity
podlove CWE-862
5.3
2024-02-07 CVE-2024-1118 SQL Injection vulnerability in Podlove Subscribe Button
The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
network
low complexity
podlove CWE-89
8.8
2023-05-23 CVE-2023-25472 Unspecified vulnerability in Podlove Podcast Publisher
Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher plugin <= 3.8.3 versions.
network
low complexity
podlove
8.8
2023-05-23 CVE-2023-25481 Cross-Site Request Forgery (CSRF) vulnerability in Podlove Subscribe Button
Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions.
network
low complexity
podlove CWE-352
8.8
2023-04-25 CVE-2023-25479 Unspecified vulnerability in Podlove Subscribe Button
Auth.
network
low complexity
podlove
4.8
2023-04-07 CVE-2023-25046 Unspecified vulnerability in Podlove Podcast Publisher
Auth.
network
low complexity
podlove
4.8
2021-09-27 CVE-2021-24666 Unspecified vulnerability in Podlove Podcast Publisher
The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P<id>[\d]+), takes an 'id' and 'category' parameters as arguments.
network
low complexity
podlove
critical
9.8
2019-09-13 CVE-2016-10942 SQL Injection vulnerability in Podlove Podcast Publisher
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.
network
low complexity
podlove CWE-89
critical
9.8