https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-13730.htmlhttps://patchthecve.com/cve/CVE-2024-13730.htmlWed, 17 Jun 2026 07:02:37 +0000MEDIUM 4.8: The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-13729.htmlhttps://patchthecve.com/cve/CVE-2024-13729.htmlWed, 17 Jun 2026 07:02:37 +0000MEDIUM 4.8: The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2025-0554.htmlhttps://patchthecve.com/cve/CVE-2025-0554.htmlWed, 17 Jun 2026 08:26:41 +0000MEDIUM 4.4: The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version <= 4.1.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbihttps://patchthecve.com/cve/CVE-2024-52393.htmlhttps://patchthecve.com/cve/CVE-2024-52393.htmlWed, 17 Jun 2026 08:07:08 +0000CRITICAL 9.1: Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Podcast Publisher: from n/a through <= 4.1.15.https://patchthecve.com/cve/CVE-2024-43984.htmlhttps://patchthecve.com/cve/CVE-2024-43984.htmlWed, 17 Jun 2026 07:52:06 +0000CRITICAL 9.6: Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher allows Code Injection.This issue affects Podlove Podcast Publisher: from n/a through 4.1.13.https://patchthecve.com/cve/CVE-2024-43983.htmlhttps://patchthecve.com/cve/CVE-2024-43983.htmlWed, 17 Jun 2026 07:52:06 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Podlove Podlove Podcast Publisher allows Stored XSS.This issue affects Podlove Podcast Publisher: from n/a through 4.1.13.https://patchthecve.com/cve/CVE-2024-32143.htmlhttps://patchthecve.com/cve/CVE-2024-32143.htmlWed, 17 Jun 2026 07:29:21 +0000MEDIUM 4.3: Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.1.0.https://patchthecve.com/cve/CVE-2024-32712.htmlhttps://patchthecve.com/cve/CVE-2024-32712.htmlWed, 17 Jun 2026 07:30:16 +0000HIGH 7.5: Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.14.https://patchthecve.com/cve/CVE-2024-32812.htmlhttps://patchthecve.com/cve/CVE-2024-32812.htmlWed, 17 Jun 2026 07:30:28 +0000MEDIUM 5.4: Server-Side Request Forgery (SSRF) vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.11.https://patchthecve.com/cve/CVE-2024-32139.htmlhttps://patchthecve.com/cve/CVE-2024-32139.htmlWed, 17 Jun 2026 07:29:21 +0000HIGH 8.5: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.12.https://patchthecve.com/cve/CVE-2024-29915.htmlhttps://patchthecve.com/cve/CVE-2024-29915.htmlWed, 17 Jun 2026 07:23:21 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podlove Podlove Podcast Publisher allows Reflected XSS.This issue affects Podlove Podcast Publisher: from n/a through 4.0.9.https://patchthecve.com/cve/CVE-2024-1118.htmlhttps://patchthecve.com/cve/CVE-2024-1118.htmlWed, 17 Jun 2026 07:03:30 +0000HIGH 8.8: The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatiohttps://patchthecve.com/cve/CVE-2024-1110.htmlhttps://patchthecve.com/cve/CVE-2024-1110.htmlWed, 17 Jun 2026 07:03:27 +0000MEDIUM 5.3: The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings.https://patchthecve.com/cve/CVE-2024-1109.htmlhttps://patchthecve.com/cve/CVE-2024-1109.htmlWed, 17 Jun 2026 07:03:27 +0000MEDIUM 5.3: The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_download() and init() functions in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to export the plugin's trac