Medium
Podlove Podcast Publisher < 4.2.1 - Admin+ Stored XSS
Type: advisorySources: OSV
The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-13730
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 01:53 UTC · Revision 1
Source evidence
Podlove Podcast Publisher < 4.2.1 - Admin+ Stored XSS
core-osv · Original sourcePublished 15 May 2025, 20:07 UTC
The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
osv:CVE-2024-13730
Complete source record
{
"id": "1f5f0650bc89e76496560aa5d576d148a47f95ad95debc032e1822ba228f0da8",
"url": "https://osv.dev/vulnerability/CVE-2024-13730",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Podlove Podcast Publisher < 4.2.1 - Admin+ Stored XSS",
"summary": "The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"evidence": "osv:CVE-2024-13730",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2024-13730",
"aliases": [
"CVE-2024-13730"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/podlove/podlove-publisher",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "78b5e4cf762a3950125a6b085fe34d3736e6cbd6"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:podlove:podlove_podcast_publisher:*:*:*:*:*:wordpress:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.2.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"4.2.0",
"4.1.25",
"4.1.24",
"4.1.23",
"4.1.22",
"4.1.21",
"4.1.20",
"4.1.19",
"4.1.18",
"4.1.17",
"4.1.16",
"4.1.15",
"4.1.14",
"4.1.13",
"4.1.12",
"4.1.11",
"4.1.10",
"4.1.9",
"4.1.8",
"4.1.7",
"4.1.6",
"4.1.5",
"4.1.4",
"4.1.3",
"4.1.2",
"4.1.1",
"4.1.0",
"4.0.15",
"4.0.14",
"4.0.13",
"4.0.12",
"4.0.11",
"4.0.10",
"4.0.9",
"4.0.8",
"4.0.7",
"4.0.6",
"4.0.5",
"4.0.4",
"4.0.3",
"4.0.2",
"4.0.1",
"4.0.0",
"3.8.12",
"3.8.11",
"3.8.10",
"3.8.9",
"3.8.8",
"3.8.7",
"3.8.6",
"3.8.5",
"3.8.4",
"3.8.3",
"3.8.2",
"3.8.1",
"3.8.1-beta2",
"3.8.1-beta1",
"3.8.0",
"3.8.0-beta5",
"3.8.0-beta4",
"3.8.0-beta3",
"3.8.0-beta2",
"3.8.0-beta1",
"3.6.1",
"3.6.0",
"3.5.6",
"3.5.5",
"3.5.4",
"3.5.3",
"3.5.2",
"3.5.1",
"3.5.0",
"3.4.2-beta2",
"3.4.2-beta1",
"3.4.1",
"3.4.0",
"3.3.2",
"3.3.1",
"3.3.0",
"3.2.2",
"3.2.1",
"3.2.0",
"3.2.0-beta5",
"3.2.0-beta4",
"3.2.0-beta3",
"3.2.0-beta2",
"3.2.0-beta1",
"3.1.18",
"3.1.17",
"3.1.16",
"3.1.15",
"3.1.14",
"3.1.13",
"3.1.12",
"3.1.11",
"3.1.10",
"3.1.9",
"3.1.8",
"3.1.7",
"3.1.6",
"3.1.4",
"3.1.3",
"3.1.1-beta7",
"3.1.2",
"3.1.1",
"3.1.1-beta6",
"3.1.1-beta5",
"3.1.1-beta4",
"3.1.1-beta3",
"3.1.1-beta2",
"3.1.1-beta1",
"3.1-beta4",
"3.1-beta3",
"3.1-beta2",
"3.1-beta1",
"3.0.4",
"3.0.2",
"3.0.1",
"3.0.0",
"2.11.4",
"2.11.3",
"2.11.2",
"2.11.1",
"2.11.0",
"refs/heads/shownotes-module",
"2.10.0",
"2.9.10",
"2.9.9",
"2.9.8",
"2.9.6",
"2.9.5",
"2.9.4",
"2.9.3",
"2.9.2",
"2.9.1",
"2.9.0",
"2.8.10",
"2.8.9",
"2.8.8",
"2.8.7",
"2.8.6",
"2.8.5",
"2.8.4",
"2.8.3",
"2.8.2",
"2.8.1",
"2.8.0",
"2.7.0",
"2.6.4",
"2.6.3",
"2.6.2",
"2.6.1",
"2.6.0",
"2.5.0",
"2.4.0",
"2.3.7",
"2.3.6",
"2.3.5",
"2.3.4",
"2.3.3",
"2.3.2",
"2.3.1",
"2.3.0",
"2.2.0",
"2.1.3",
"2.1.2",
"2.1.1",
"2.1.0",
"2.0.5",
"2.0.4",
"2.0.3",
"2.0.2",
"2.0.1",
"2.0.0",
"1.11.2-alpha",
"1.11.1-alpha",
"1.11-alpha",
"1.10.23-alpha",
"1.10.22-alpha",
"1.10.21-alpha",
"1.10.20-alpha",
"1.10.19-alpha",
"1.10.18-alpha",
"1.10.17-alpha",
"1.10.16-alpha",
"1.10.15-alpha",
"1.10.14-alpha",
"1.10.11-alpha",
"1.10.10-alpha",
"1.10.9-alpha",
"1.10.8-alpha",
"1.10.7-alpha",
"1.10.6-alpha",
"1.10.5-alpha",
"1.10.4-alpha",
"1.10.3-alpha",
"1.9.12-alpha",
"1.9.11-alpha",
"1.9.10-alpha",
"1.9.9-alpha",
"1.9.8-alpha",
"1.9.5-alpha",
"1.9.6-alpha",
"1.9.4-alpha",
"1.9.3-alpha"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-13730.json"
}
}
],
"modified": "2026-10-28T02:30:41.577853946Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13730.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-13730",
"https://wpscan.com/vulnerability/4541a285-a095-4178-a64b-6a859eb5034e/"
],
"provider_metadata": {
"cna_assigner": "WPScan",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "4.2.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13730.json"
}
},
"related_cves": [
{
"value": "CVE-2024-13730",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 509247,
"published_at": "2025-05-15T20:07:04.496+00:00"
}