CVE-2026-13729

Name of the Vulnerable Software and Affected Versions Podlove Podcast Publisher versions prior to 4.5.3

Description Cross-Site Request Forgery (CSRF) occurs because the plugin fails to perform nonce validation—a security mechanism used to protect against forged requests—on certain administrative create and delete actions. This allows an attacker to trick a logged-in administrator into visiting a crafted page, which can result in the creation of rogue records or the deletion of legitimate ones.

Recommendations Update Podlove Podcast Publisher to version 4.5.3 or later.