CVE-2025-66061
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Seriously Simple Podcasting plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF). This issue affects versions up to and including 3.13.0 and allows unauthorized actions in the context of a logged-in user.
Risk Assessment
An attacker could trick an administrator into unknowingly performing actions, potentially leading to plugin configuration changes or other unwanted effects.
Recommendation
Update the Seriously Simple Podcasting plugin to the latest version (above 3.13.0) that includes the security fix.
Other vulnerabilities in Seriously Simple Podcasting
See all- CVE-2026-112834Medium
The Seriously Simple Podcasting WordPress plugin through 3.17.0 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2026-112833Medium
The Seriously Simple Podcasting WordPress plugin through 3.17.0 contains a stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
- CVE-2026-39505Medium
The WordPress plugin Seriously Simple Podcasting up to version 3.14.2 suffers from a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2025-66060Medium
The Seriously Simple Podcasting (seriously-simple-podcasting) plugin up to version 3.13.0 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2025-66059Medium
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Craig Hewitt Seriously Simple Podcasting (seriously-simple-podcasting) allows retrieval of embedded sensitive data. This issue affects Seriously Simple Podcasting versions up to and including 3.13.0.
- CVE-2025-62882Medium
The Seriously Simple Podcasting (seriously-simple-podcasting) plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.13.0.
- CVE-2025-49923Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows DOM-Based XSS. This issue affects Seriously Simple Podcasting: from n/a through <= 3.11.1.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Cross Site Request Forgery.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS