CVE-2024-10189

Published
View on NVD ↗
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT

Description

The Anchor Episodes Index (Spotify for Podcasters) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's anchor_episodes shortcode in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

<p>This plugin appends an episode index to the anchor.fm podcast player. Currently, the only available embed for the anchor.fm player is for a single episode.<br /> This plugin allows you to add your entire episode index, just the same as you have on your anchor.fm site.<br /> Simply input your site and RSS URL&#8217;s on the settings page and add the shortcode to any page or post.</p> <p>Email me <a href="mailto:&#x6a;&#101;&#115;&#x73;&#101;&#064;&#x6a;&#101;&#x73;&#x77;&#101;&#x62;&#x2e;&#100;&#x65;v" rel="nofollow ugc">here</a> for suggestions and feedback.</p> <h3>Announcements</h3> <ul> <li>Anchor Episodes Index Pro is available now! <a href="https://jesweb.dev" rel="nofollow ugc">Learn more here</a></li> </ul> <h3>Usage</h3> <p>Firstly, install and activate Anchor Episodes Index (this plugin).</p> <p>Once activated, go to the settings and fill out the Anchor Site URL and Anchor RSS URL fields (be sure to add the URL&#8217;s without a &#8220;/&#8221; at the end, otherwise it will not work).</p> <p>Then copy the shortcode you&#8217;ll see on the settings page and paste it in any page or post.</p> <p>If you want to add multiple different podcasts on the site, you can define the RSS and Site URL&#8217;s as shortcode attributes instead of on the settings page. Note, you cannot currently output more than one player on one page.</p> <h3>Shortcode examples</h3> <p>Uses values set in the settings page:<br /> [anchor_episodes]<br /> Overrides values set on the settings page:<br /> [anchor_episodes site_url=&#8221;https://anchor.fm/your-podcast&#8221; rss_url=&#8221;https://anchor.fm/s/123456-your-key/podcast/rss&#8221; max_episodes=&#8221;10&#8243;]</p>
WordPress Plugin DirectoryWordPress Plugin Directory
46.4K