PowerPress Podcasting plugin by Blubrry - XML injection (XXE)

 530 | }
 531 | }
 532 | return ($returnkey ? $minkey : $minvalue);
 533 | }
 534 |
 535 | public static function XML2array($XMLstring) {
 536 | if (function_exists('simplexml_load_string') && function_exists('libxml_disable_entity_loader')) {
 537 | // http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html
 538 | // https://core.trac.wordpress.org/changeset/29378
 539 | $loader = libxml_disable_entity_loader(true);
>  540 |    $XMLobject = simplexml_load_string($XMLstring, 'SimpleXMLElement', LIBXML_NOENT);
   541 |    $return = self::SimpleXMLelement2array($XMLobject);
   542 |    libxml_disable_entity_loader($loader);
   543 |    return $return;
   544 |   }
   545 |   return false;
   546 |  }
   547 |
   548 |  public static function SimpleXMLelement2array($XMLobject) {
   549 |   if (!is_object($XMLobject) && !is_array($XMLobject)) {
   550 |    return $XMLobject;
       ^ Col 0