{"id":"CVE-2026-112833","kind":"vulnerability","aliases":["CVE-2026-112833"],"related":[],"title":"Seriously Simple Podcasting WordPress plugin: stored XSS through version 3.17.0","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0.","summary":"The Seriously Simple Podcasting WordPress plugin by Castos fails to neutralize input before generating web pages, which allows stored cross-site scripting. An attacker who can get script stored in the plugin's content can run it in the browser of anyone who views the affected page, such as an admin.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","podcasting","self-hosted","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get seriously-simple-podcasting --field=version`\n- Compare against the affected range: versions up to and including `3.17.0`","fix":"- Update Seriously Simple Podcasting to a version later than `3.17.0`; the sources do not name the fixed version, so check the plugin's changelog\n- Until updated, restrict who can add podcast content or episode metadata","status":"open","published_at":"2026-10-20T15:17:14+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:55:36+00:00","updated_at":"2026-10-25T03:55:36+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:55:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update Seriously Simple Podcasting to a version later than `3.17.0`; the sources do not name the fixed version, so check the plugin's changelog\n- Until updated, restrict who can add podcast content or episode metadata","reach":"internet","title":"Seriously Simple Podcasting WordPress plugin: stored XSS through version 3.17.0","impact":"medium","summary":"The Seriously Simple Podcasting WordPress plugin by Castos fails to neutralize input before generating web pages, which allows stored cross-site scripting. An attacker who can get script stored in the plugin's content can run it in the browser of anyone who views the affected page, such as an admin.","category":"other","nicknames":[],"who_cares":["wordpress","self-hosted","podcasting"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in a victim's browser on the site","analyst_note":"Check the Wiordpress.org plugin changelog or the Patchstack/WPScan entry for the fixed version and the required privilege level for the stored input.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get seriously-simple-podcasting --field=version`\n- Compare against the affected range: versions up to and including `3.17.0`","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the Seriously Simple Podcasting WordPress plugin at version 3.17.0 or earlier are affected. The sources do not say which roles can store the malicious input, so the exposure depends on who can write podcast fields on your site. Sites without this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000644,"input_tokens":3323,"output_tokens":624,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112833':13A,16A '-2026':12A,15A '3.17.0':10A,108C 'admin':74B 'affect':69B,101C 'allow':40B,97C 'anyon':65B 'attack':47B 'browser':63B 'casto':30B,89C 'content':57B 'cross':43B,84C 'cross-sit':42B,83C 'cve':11A,14A 'fail':31B 'generat':36B,82C 'get':50B 'host':21B 'improp':75C 'input':34B,78C 'issu':100C 'n/a':106C 'neutral':33B,76C 'page':38B,70B,81C 'plugin':5A,28B,55B 'podcast':3A,18B,26B,92C,96C,104C 'run':59B 'script':45B,51B,86C 'self':20B 'self-host':19B 'serious':1A,24B,90C,94C,102C 'seriously-simple-podcast':93C 'simpl':2A,25B,91C,95C,103C 'site':44B,85C 'store':6A,41B,52B,98C 'version':9A 'view':67B 'vulner':87C 'web':37B,80C 'wordpress':4A,22B,27B 'xss':7A 'xss.this':99C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Seriously Simple Podcasting WordPress plugin at version 3.17.0 or earlier are affected. The sources do not say which roles can store the malicious input, so the exposure depends on who can write podcast fields on your site. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T15:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112833","severity":null,"published_at":"2026-10-20T15:17:14+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}