If you run PodcastGenerator on your website, you need to pay attention.

Here's the deal. Someone with admin access can type JavaScript into a Live Item. The app saves it. Then it runs. Not just for the admin, but for anyone who visits your public Live Stream page.

Researcher Sahil Arya found it. It's CVE-2025-70336.

The Short Version

What Is PodcastGenerator?

It's a free podcast publishing tool. No database needed. Just upload audio files and manage episodes from a web admin panel. Popular with independent podcasters and small orgs.

The bug is in the Live Items feature. That's the part that lets you create live stream events with titles and descriptions.

How the Bug Works

Stored XSS is simple. The attacker doesn't need to trick you into clicking anything. They just get their payload saved on the server. Then it runs for everyone who views the page.

An admin types JavaScript into the TITLE, SHORT DESCRIPTION, or LONG DESCRIPTION field of a Live Item. Saves it. Done.

The JavaScript runs in two places:

• /admin/live_list.php (the admin listing)
• /live.php (the public Live Stream page)

That second one is the problem. No login required. Any visitor triggers it.

The Proof of Concept

Sahil Arya published a simple PoC:

1. Log in to the PodcastGenerator admin panel.
2. Navigate to /admin/live_create.php.
3. Insert <script>alert(document.domain)</script> into TITLE, SHORT DESCRIPTION, or LONG DESCRIPTION.
4. Save the Live Item.
5. Navigate to /admin/live_list.php - the JavaScript executes.
6. Open the public Live Stream page (/live.php) as an unauthenticated user - the same payload executes again.

That's it. No complicated exploitation. Just a script tag in a form field.

Why It Matters 

Let's be honest about the risk here. The attacker needs admin access to inject the payload. So this isn't a "anyone on the internet can hack you" bug.

But think about it this way. If someone already has admin access, they can do plenty of damage. This just gives them another way to mess with your visitors.

The JavaScript can steal cookies, grab session tokens, redirect people to phishing pages, or just make your site look broken.

So it's not a five-alarm fire. But it's worth fixing.

Who's Affected

• Version 3.2.9. Maybe older versions too. Hard to say without more testing.
• If you don't use Live Items, you're probably fine. But you should still update when a patch drops.

What to Do

• Update when a patch is available. Check the GitHub repo.
• Sanitize your inputs. If you're a developer, escape user data before rendering it. htmlspecialchars() is your friend.
• Lock down admin access. Strong passwords. Two-factor if you can. Don't give admin to people who don't need it.
• Watch for weird Live Items. If someone's been messing around, you'll see it.

The Bottom Line

Stored XSS in PodcastGenerator 3.2.9. Admin injects. Public triggers. Update when you can. Sanitize your inputs. Don't lose sleep over it, but don't ignore it either.

Quick Reference:

FAQ Section

What is CVE-2025-70336?

A stored XSS bug in PodcastGenerator 3.2.9. An admin can inject JavaScript through Live Items that runs when anyone visits the public Live Stream page.

How does it work?

Admin types JavaScript into a Live Item field. The app saves it. It runs for anyone who views the Live Item listing or the public Live Stream page.

Do I need admin access to exploit this?

Yes. Injection requires admin. But the payload runs for unauthenticated visitors.

Is there a patch available?

Please check GitHub repository. If not, consider disabling Live Items or sanitizing inputs manually.

What can the JavaScript code do?

It can steal cookies, session tokens, and even redirect your user or mess with your site.

Source: Exploit DB