EUVD-2026-37862
GHSA-6mj9-8qq5-v945
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
UI:R corrects the provided vector - stored XSS requires a victim to visit the injected page; PR:L reflects mandatory author-level authentication; S:C captures cross-browser script execution.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed' Episode Meta Field in all versions up to, and including, 11.16.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The embed value is stored via update_post_meta() rather than through WordPress core's post content pipeline, meaning kses-on-save filtering is never applied - even for Author-role users who would otherwise lack unfiltered_html - making this path unprotected by WordPress's standard role-based XSS mitigations.
AnalysisAI
Stored Cross-Site Scripting in PowerPress Podcasting plugin by Blubrry (WordPress, versions ≤ 11.16.8) allows authenticated attackers with Author-level access to plant persistent JavaScript payloads via the 'embed' Episode Meta Field, executing in every visitor's browser on affected episode pages. The vulnerability is architecturally significant because the embed value is written through update_post_meta() rather than WordPress's post content pipeline, causing kses sanitization to be skipped entirely - bypassing the role-based XSS mitigations that WordPress normally enforces even for Author-role users who lack the unfiltered_html capability. No public exploit or CISA KEV listing has been identified at time of analysis, though the low authentication barrier (Author level) makes multi-author WordPress sites an elevated-risk target.
Technical ContextAI
The affected component is the PowerPress Podcasting plugin by Blubrry (CPE: cpe:2.3:a:blubrry:powerpress_podcasting_plugin_by_blubrry:*:*:*:*:*:*:*:*), a widely-used WordPress podcasting plugin. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting): user-supplied data in the 'embed' Episode Meta Field is stored without sanitization and rendered without output escaping. The critical technical nuance is the storage pathway: the plugin calls update_post_meta() directly, which writes to the WordPress wp_postmeta table outside the standard post content pipeline. WordPress applies wp_kses_post() (kses-on-save) filtering only to post content passed through its core editor pipeline; data stored via update_post_meta() bypasses this entirely. Consequently, even Author-role users - who normally cannot save unfiltered HTML because they lack the unfiltered_html capability - can persist arbitrary scripts through this unguarded meta field. The vulnerable code paths are documented at powerpress.php lines 659 and 420, and powerpressadmin.php line 2984, visible in the WordPress plugin trac browser for both versions 11.16.4 and 11.16.8.
RemediationAI
An upstream fix has been committed per the WordPress plugin trac changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3575897%40powerpress&new=3575897%40powerpress; however, the specific patched release version number is not independently confirmed from the available data - administrators should check the WordPress plugin repository for a release newer than 11.16.8 and upgrade immediately upon availability. Until a patched version is confirmed and deployed, the primary compensating control is auditing and restricting Author-level (and above) access on multi-author sites, revoking posting rights from untrusted contributors - note this may impact legitimate publishing workflows. A secondary control is deploying a Web Application Firewall rule to block common XSS payload patterns in post meta input; this reduces but does not eliminate exposure and may produce false positives on legitimate embed code. Monitoring the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7a74e4fb-15a9-4fc9-afa6-396b0f026615?source=cve for confirmed patch version details is recommended.
Server-Side Request Forgery in the PowerPress Podcasting plugin by Blubrry for WordPress (versions before 11.17.1) allow
Stored Cross-Site Scripting in the PowerPress Podcasting plugin by Blubrry (WordPress) before version 11.16.11 allows an
Stored cross-site scripting in Blubrry PowerPress plugin versions up to 11.15.15 allows authenticated contributors and a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today