medium5.3
CVE-2026-14860
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenti…
Impact
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.
Affected products
| Product | Affected versions |
|---|---|
| Podcast Player WordPress Plugin | before 8.3.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.