CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-32143 – WordPress Podlove Podcast Publisher plugin <= 4.1.0 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-32143
Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.1.0. Vulnerabilidad de autorización faltante en Podlove Podlove Podcast Publisher. Este problema afecta a Podlove Podcast Publisher: desde n/a hasta 4.1.0. The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions such as do_repair() in versions up to, and including, 4.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions. • https://patchstack.com/database/vulnerability/podlove-podcasting-plugin-for-wordpress/wordpress-podlove-podcast-publisher-plugin-4-1-0-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29915 – WordPress Podlove Podcast Publisher plugin <= 4.0.9 - Reflected Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-29915
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podlove Podlove Podcast Publisher allows Reflected XSS.This issue affects Podlove Podcast Publisher: from n/a through 4.0.9. La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('cross-site Scripting') en Podlove Podlove Podcast Publisher permite el XSS reflejado. Este problema afecta a Podlove Podcast Publisher: desde n/a hasta 4.0.9. The Podlove Podcast Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/podlove-podcasting-plugin-for-wordpress/wordpress-podlove-podcast-publisher-plugin-4-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •