This vulnerability results from improper neutralization of user input, enabling reflected XSS. An attacker can embed malicious scripts into URLs that, when visited by any user, execute in that user's browser, potentially hijacking sessions, defacing content, or facilitating phishing attacks. The weakness is a classic input‑validation flaw identified as CWE‑79.

WordPress sites running the Blubrry PowerPress Podcasting plugin Multi‑Site add‑on version 0.1.1 or earlier, distributed by Angelo Mandato. Multi‑site installations are particularly vulnerable, as the flaw can affect all sites within the network.

The CVSS score of 7.1 indicates moderate risk, and the EPSS score of <1% suggests a low likelihood of exploitation as of this assessment. The plugin does not require authentication, so any user who receives a crafted link can exploit the flaw. Although this vulnerability is not listed in CISA's KEV catalog, the potential impact on a multi‑site environment warrants prompt action.