CVE-2026-93775

Name of the Vulnerable Software and Affected Versions Podlove Podcast Publisher versions prior to 4.5.7

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs when a request is sent to the Auphonic webhook endpoint with a POST body where the status string field is not equal to 'Done'. This action causes the raw POST superglobal to be stored in the plugin log before authentication key validation, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page.

Recommendations Update to a version newer than 4.5.6. Restrict access to the Auphonic webhook endpoint to minimize the risk of exploitation.