CVE-2024-13730: 
WordPress vulnerability analysis and mitigation

The Podlove Podcast Publisher WordPress plugin before version 4.2.1 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-13730. The vulnerability was discovered in the plugin's settings functionality where certain fields are not properly sanitized and escaped. This security issue affects WordPress installations using the Podlove Podcast Publisher plugin versions prior to 4.2.1 (WPScan).

The vulnerability stems from improper sanitization and escaping of settings fields in the plugin, specifically in the 'Summary' textarea field located in the podcast description settings page. The issue has been classified under CWE-79 (Cross-Site Scripting) and has been assigned a CVSS score of 4.8 (medium severity) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (WPScan, NVD).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is explicitly disallowed, such as in multisite WordPress setups (WPScan).

Users should update their Podlove Podcast Publisher plugin to version 4.2.1 or later, which contains the fix for this vulnerability (WPScan).