EUVD-2026-52596
GHSA-x9vf-qhcr-qmmf
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor is a low-privilege role (PR:L not PR:H); XSS crosses browser security boundary to victim session (S:C); no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
AnalysisAI
Stored Cross-Site Scripting in the PowerPress Podcasting plugin by Blubrry (WordPress) before version 11.16.11 allows any authenticated user holding the Contributor role to inject and persist arbitrary JavaScript via unsanitized Podcast Episode settings fields. The injected payload executes in the browsers of higher-privileged users - including editors and administrators - who view the affected content, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed by CISA KEV, and the EPSS probability stands at a low 0.15%, suggesting opportunistic rather than widespread exploitation at this time.
Technical ContextAI
PowerPress Podcasting by Blubrry is a WordPress plugin (CPE: cpe:2.3:a:unknown:powerpress_podcasting_plugin_by_blubrry:*:*:*:*:*:*:*:*) that extends WordPress with podcast episode management. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting). The root cause is a failure to apply proper output encoding and input sanitization to one or more Podcast Episode settings fields before rendering them in the WordPress admin interface or front end. Critically, the plugin does not enforce WordPress's unfiltered_html capability gate on these fields, meaning Contributors - who by design cannot inject raw HTML in standard post content - can still introduce malicious script via this plugin's settings. This represents a bypass of WordPress's native privilege-based content filtering model.
RemediationAI
The primary remediation is to upgrade the PowerPress Podcasting plugin by Blubrry to version 11.16.11 or later, which contains the vendor-released patch for this issue. The fix is confirmed available via the WordPress plugin repository and the WPScan advisory at https://wpscan.com/vulnerability/04aa5ba8-2654-4e71-90af-83cfd92635f8/. Sites unable to patch immediately should consider restricting the Contributor role from creating or editing Podcast Episodes within the plugin's settings, or temporarily disabling the PowerPress plugin if podcast functionality is non-critical. Restricting new user registrations at the Contributor level reduces the external attack surface. Note that disabling the plugin will interrupt podcast feed functionality. Applying a Web Application Firewall rule to block script-tag injection in POST requests to the plugin's settings endpoints is a partial compensating control but may not cover all XSS payload forms and should not substitute for patching.
Server-Side Request Forgery in the PowerPress Podcasting plugin by Blubrry for WordPress (versions before 11.17.1) allow
Stored Cross-Site Scripting in PowerPress Podcasting plugin by Blubrry (WordPress, versions ≤ 11.16.8) allows authentica
Stored cross-site scripting in Blubrry PowerPress plugin versions up to 11.15.15 allows authenticated contributors and a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today