CVE-2026-112833
MediumCVSS 6.5Summary
The Seriously Simple Podcasting WordPress plugin through 3.17.0 contains a stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
Risk Assessment
An attacker could inject malicious script that executes in a user's browser, potentially leading to session theft or account takeover.
Recommendation
Update the Seriously Simple Podcasting plugin to the latest version (above 3.17.0).
Other vulnerabilities in Seriously Simple Podcasting
See all- CVE-2026-112834Medium
The Seriously Simple Podcasting WordPress plugin through 3.17.0 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2026-39505Medium
The WordPress plugin Seriously Simple Podcasting up to version 3.14.2 suffers from a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2025-66061Medium
The Seriously Simple Podcasting plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF). This issue affects versions up to and including 3.13.0 and allows unauthorized actions in the context of a logged-in user.
- CVE-2025-66060Medium
The Seriously Simple Podcasting (seriously-simple-podcasting) plugin up to version 3.13.0 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2025-66059Medium
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Craig Hewitt Seriously Simple Podcasting (seriously-simple-podcasting) allows retrieval of embedded sensitive data. This issue affects Seriously Simple Podcasting versions up to and including 3.13.0.
- CVE-2025-62882Medium
The Seriously Simple Podcasting (seriously-simple-podcasting) plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.13.0.
- CVE-2025-49923Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows DOM-Based XSS. This issue affects Seriously Simple Podcasting: from n/a through <= 3.11.1.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS