PowerPress Podcasting CVE-2026-97319

Requires an authenticated WordPress account with the contributor role or higher on a site running the PowerPress Podcasting plugin by Blubrry before 11.17.2. The attacker must be able to add/edit a PowerPress block and inject a payload into the vulnerable block attribute, and a higher-privileged user (editor/admin) must subsequently view the rendered content (UI:R) for the stored script to execute. Limiting factors: valid low-privilege authentication is needed (rules out fully anonymous attack), victim interaction is required, and impact is bounded to actions executable in the victim's browser session; sites that disable open registration and restrict contributor accounts materially reduce exposure.

This is a moderate-risk, authenticated stored XSS that the vendor CVSS (6.8, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) arguably overstates on both privilege and impact. The vector lists PR:H, yet the description explicitly says exploitation requires only the 'contributor role and above' - contributor is a LOW-privilege authenticated role in WordPress, so PR:L is more defensible than PR:H; this is a signal conflict worth verifying. The C:H/I:H/A:H impact triple is also aggressive for a reflected-into-page block-attribute XSS, whose realistic effect is script execution in the browser of a higher-privileged user who views the content (typical WPScan-scored WordPress XSS lands closer to C:L/I:L). Corroborating signals point to low real-world urgency: EPSS is 0.15% (4th percentile), SSVC records Exploitation=none and Automatable=no (though Technical Impact=total), and the issue is NOT in CISA KEV. A public exploit exists (WPScan), and Technical Impact=total reflects that a successful payload against an admin could pivot to full site takeover, so this is not negligible - but the low EPSS, no active exploitation, required authentication, and required victim interaction (UI:R) place it as a real-but-not-urgent patch item rather than an emergency.

An attacker with a contributor account (self-registered on open-registration sites, or an insider/compromised low-privilege account) inserts a malicious PowerPress block whose unsanitized attribute carries a JavaScript payload. When an editor or administrator previews or opens the resulting page, the script executes in their authenticated session, enabling session/cookie theft or admin actions leading to site takeover. A public exploit is available via WPScan, and the network/low-complexity vector makes crafting the payload straightforward.