Description
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed' Episode Meta Field in all versions up to, and including, 11.16.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The embed value is stored via update_post_meta() rather than through WordPress core's post content pipeline, meaning kses-on-save filtering is never applied — even for Author-role users who would otherwise lack unfiltered_html — making this path unprotected by WordPress's standard role-based XSS mitigations.
Published: 2026-06-18
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The PowerPress Podcasting plugin for WordPress is vulnerable to authenticated stored XSS via the 'embed' episode meta field. Classified as CWE‑79, it permits users with author-level or higher privileges to insert arbitrary JavaScript that is saved directly via update_post_meta(), bypassing WordPress’s kses filtering. Any user who views a page that renders the embed value will execute the injected script, enabling attackers to hijack sessions, deface content, or deliver malware.

Affected Systems

Blubrry PowerPress Podcasting plugin for WordPress, versions up to and including 11.16.8.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1 % means the likelihood of exploitation is currently very low. The vulnerability is not listed in CISA’s KEV catalog. Attackers require authenticated access at author level or higher; once injected, the script runs for all viewers of the affected pages.

Generated by OpenCVE AI on June 18, 2026 at 18:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to version 11.16.9 or later, which removes the insecure meta field handling and mitigates the CWE‑79 vulnerability.
  • If an upgrade is not possible, clear all 'embed' meta values that contain malicious code and block authors from editing this field by removing the corresponding metabox or disabling episode editing capabilities, reducing CWE‑79 risk.
  • Add a WordPress filter that sanitizes the meta value before it is stored, implementing input validation and output escaping to defend against future CWE‑79 attacks.

Generated by OpenCVE AI on June 18, 2026 at 18:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 18 Jun 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Blubrry
Blubrry powerpress Podcasting Plugin By Blubrry
Wordpress
Wordpress wordpress
Vendors & Products Blubrry
Blubrry powerpress Podcasting Plugin By Blubrry
Wordpress
Wordpress wordpress

Thu, 18 Jun 2026 16:45:00 +0000

Type Values Removed Values Added
Description The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed' Episode Meta Field in all versions up to, and including, 11.16.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The embed value is stored via update_post_meta() rather than through WordPress core's post content pipeline, meaning kses-on-save filtering is never applied — even for Author-role users who would otherwise lack unfiltered_html — making this path unprotected by WordPress's standard role-based XSS mitigations.
Title PowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta Field
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Blubrry Powerpress Podcasting Plugin By Blubrry
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-06-18T13:02:35.708Z

Reserved: 2026-06-12T14:18:22.451Z

Link: CVE-2026-12098

cve-icon Vulnrichment

Updated: 2026-06-18T13:02:30.796Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T19:15:02Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')