CVE-2018-20121: Podcast Generator 2.7 has stored cross-site scripting (XSS) via the URL addcategory parameter.

Security readout for executives and security teams

Podcast Generator 2.7 can store attacker-controlled script content through the addcategory URL parameter. If viewed later by an administrator or user, that script could run in their browser. The sources do not provide a CVSS score, affected version range beyond 2.7, or confirmed active exploitation. Exposure is likely limited to organizations running Podcast Generator 2.7, especially if category management or affected pages are reachable by untrusted or lower-privileged users. The source bundle lists affected vendor and product metadata as n/a, so asset owners must verify deployments manually. Treat this as a moderate web-application risk. It is unlikely to justify emergency action without evidence of exposure, but internet-facing Podcast Generator 2.7 sites should be inventoried and remediated promptly because stored XSS can compromise sessions and administrative actions. Mitigation focus: Identify any Podcast Generator 2.7 deployments and prioritize them for review.; Check vendor project commits and advisories for supported remediation guidance.; Restrict administration and category-management access to trusted users..

Prepared

Jun 6, 2026, 21:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.