CVE-2025-0554

Summary

CVE-2025-0554 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Podlove Podcast Publisher plugin for WordPress. This issue, occurring in versions <= 4.1.25, arises due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level access can exploit this vulnerability by injecting arbitrary web scripts into the Feed Name value. The consequence is the execution of these scripts whenever a user accesses an injected page. Notably, this vulnerability only impacts multi-site installations and installations where unfiltered_html has been disabled.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.