CVE Catalog
CVE-2026-14860
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk0.24%
15th percentile - higher than 15% of all known CVEs
Summary
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.
Risk Assessment
Risk of SSRF attacks, potential access to internal resources or data.
Recommendation
Update the Podcast Player plugin to version 8.3.1 or later.
Original NVD description (English source)
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.