CVE-2026-14860
N/A
N/A
Summary
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Podcast Player | 0 < 8.3.1 | affected |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.