This vulnerability is an instance of Improper Neutralization of Input During Web Page Generation (CWE-79), as described in the CVE description. It allows stored XSS in the blubrry PowerPress Podcasting plugin for WordPress, meaning a malicious script can be persisted in plugin data and served to any visitor who views affected pages. If exploited, an attacker could inject arbitrary JavaScript that runs in the context of the site, potentially leading to cookie theft, session hijacking, defacement, or further compromise of site users.

All installations of the PowerPress Podcasting plugin up to and including version 11.15.13 are affected. The vulnerability applies to every release from the earliest available version (n/a) through 11.15.13 inclusive, so any site running any of those versions is at risk.

The CVSS score of 5.9 indicates a moderate impact, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present; it is not listed in CISA’s KEV catalog. Exploitation likely requires the ability to submit or modify content via the plugin’s data entry interface, either through an authenticated administrative account or through a publicly exposed input. The vulnerability does not require advanced privileges beyond this ability, making it a relatively low-barrier attack vector.