CVE-2026-13729— Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Podlove Podcast Publisher | < 4.5.3 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-13729
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF
Source: CVE Program / CVE List V5
Vulnerability Description
The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Podlove Podcast Publisher 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Podlove Podcast Publisher是WordPress基金会的一款播客发布插件。 WordPress Podlove Podcast Publisher 4.5.3之前版本存在跨站请求伪造漏洞，该漏洞源于对部分管理创建和删除操作未进行nonce验证，可能导致跨站请求伪造攻击，使攻击者能够创建恶意记录或删除合法记录。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Podlove Podcast Publisher | 0 ~ 4.5.3 | - |
II. Public POCs for CVE-2026-13729
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13729
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-13729 (1)
Same Patch Batch · Unknown · 2026-08-01 · 30 CVEs total
| CVE-2026-13604 | Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX | |
| CVE-2025-15669 | Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label | |
| CVE-2026-12966 | Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering v | |
| CVE-2026-15932 | Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal | |
| CVE-2026-14309 | Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass | |
| CVE-2026-14596 | DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Lin | |
| CVE-2026-14836 | Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limi | |
| CVE-2026-14197 | Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR | |
| CVE-2026-15244 | HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File In | |
| CVE-2026-15368 | Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registrat | |
| CVE-2026-15234 | Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute | |
| CVE-2026-15262 | Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column | |
| CVE-2026-13157 | Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload | |
| CVE-2026-13158 | Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload | |
| CVE-2026-10827 | Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via B | |
| CVE-2026-14840 | YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing | |
| CVE-2026-13596 | Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search | |
| CVE-2026-13329 | WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund | |
| CVE-2026-12696 | wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field | |
| CVE-2026-11882 | Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Podlove Podcast Publisher
- CVE-2026-16099
Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contribu - CVE-2026-13001
Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitra - CVE-2026-32448
WordPress Podlove Podcast Publisher plugin <= 4.3.3 - Cross - CVE-2025-10147
Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitra - CVE-2025-58204
WordPress Podlove Podcast Publisher Plugin <= 4.2.5 - Open R
Same vendor: Unknown
- CVE-2026-14832
ShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated - CVE-2026-13700
WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery - CVE-2026-19726
Visualizer < 4.0.7 - Contributor+ Cross-User Chart Configura - CVE-2026-19728
Extra Product Options Builder for WooCommerce < 1.2.176 - Un - CVE-2026-19725
WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path
V. Comments for CVE-2026-13729
No comments yet