Podcast Generator 3.1 Persistent Cross-Site Scripting via long_description
Priority MEDIUM 56CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Podcast Generator 3.1 is vulnerable to persistent cross-site scripting, allowing authenticated attackers to inject malicious scripts by submitting unfiltered JavaScript code in the long_description parameter. Attackers can inject script tags through episode creation or editing requests to execute arbitrary JavaScript when other users view the episode details.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00193 9th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Podcast Generator (Podcastgenerator): 3.1.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Podcastgenerator | Podcast Generator | before 3.1.1 | 3.1.1 | Patch available | CNA |
- Podcast Generator VendorPodcastgenerator Affected before 3.1.1 Fixed in 3.1.1 Patch available CNA
Remediation
- Fix · CNA Podcast Generator (Podcastgenerator) Fixed in 3.1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-47968
- 2026-10-03 Alias added: GHSA-7rjr-6xrm-45m8
References
Exploit 1
More Podcastgenerator vulnerabilities
- TI-2023-30182 PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection CVSS 4.0MEDIUM 5.1
- TI-2023-30203 PodcastGenerator Stored Cross-Site Scripting via Podcast Title Field CVSS 4.0MEDIUM 5.1
- TI-2023-30202 PodcastGenerator Stored Cross-Site Scripting via Freebox Content Field CVSS 4.0MEDIUM 5.1
- TI-2023-30201 PodcastGenerator Stored Cross-Site Scripting via Episode Title Field CVSS 4.0MEDIUM 5.1
- TI-2018-14251 Podcast Generator 2.7 has stored cross-site scripting (XSS) via the URL addcategory parameter. CVSS 3.0MEDIUM 6.1
- TI-2025-43101 A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in… CVSS 3.1MEDIUM 4.8
Sources
- CVE-2021-47968 · CVE Program
- CVE-2021-47968 · NVD
- FIRST EPSS
- GHSA-7rjr-6xrm-45m8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences