CVE-2025-70336

4.8 mediumEPSS 0.6%

Medium (4.8) in podcastgenerator podcast generator. EPSS 0.6% chance of exploitation in the next 30 days.

A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTML via the 'TITLE', 'SHORT DESCRIPTION' and 'LONG DESCRIPTION' parameters. The saved payload gets executed on 'View All Live Items' and 'Live Stream' pages.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-01-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

podcastgenerator:podcast_generator

References

https://github.com/PodcastGenerator/PodcastGenerator
https://github.com/aryasahil96-manu/CVE-Disclosures/blob/main/CVE-2025-70336

Check your stack JSON