The vulnerability is an improper neutralization of input that permits DOM‑based cross‑site scripting within the PowerPress Podcasting plugin. When untrusted data is included in generated pages, an attacker can inject malicious JavaScript that executes in the victim’s browser context.

WordPress installations that use blubrry PowerPress Podcasting plugin version 11.12.5 or earlier are affected. The flaw spans all releases from the initial version through 11.12.5.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog. As a DOM‑based flaw, exploitation requires delivery of crafted input—typically a malicious URL or content—to a victim’s browser, meaning attacker success depends on user interaction with the vulnerable site.