CVE-2025-49923
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows DOM-Based XSS. This issue affects Seriously Simple Podcasting: from n/a through <= 3.11.1.
Risk Assessment
An attacker can inject malicious scripts that execute in the user's browser, potentially leading to session data theft or other attacks.
Recommendation
Update the Seriously Simple Podcasting plugin to a version later than 3.11.1 if available to fix the vulnerability.
Other vulnerabilities in Seriously Simple Podcasting
See all- CVE-2026-39505Medium
The WordPress plugin Seriously Simple Podcasting up to version 3.14.2 suffers from a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2025-62882Medium
The Seriously Simple Podcasting (seriously-simple-podcasting) plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.13.0.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows DOM-Based XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.11.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS