CVE-2026-16293
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The PowerPress Podcasting plugin by Blubrry for WordPress before version 11.16.11 does not sanitize and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Risk Assessment
A user with Contributor role can inject malicious scripts that execute in the browser of an administrator or other users, potentially leading to session hijacking or data theft.
Recommendation
Update the plugin to version 11.16.11 or later. Restrict user privileges and apply the principle of least privilege.
Other vulnerabilities in PowerPress Podcasting
See all- CVE-2026-16294High
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.
- CVE-2026-24637High
SQL Injection vulnerability in PowerPress Podcasting versions <= 11.15.10 allows attackers to inject malicious SQL queries.
Original NVD description (English source)
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.