sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total21
Critical1
High3
Medium17
Reset
Showing 1-20 of 21 records
Threat Entry Updated 2026-06-18

Powerpress - Cross-Site Scripting (XSS) (CVE-2026-12098)

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed' Episode Meta Field in all versions up to, and including, 11.16.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The embed value is stored via update_post_meta() rather than through WordPress core's post content pipeline, meaning kses-on-save filtering is never applied — even for Author-role…

PLUGIN Powerpress

CVE-2026-12098

MEDIUM CVSS 6.4 2026-06-18
Open Full Technical Breakdown
Threat Entry Updated 2026-07-25

Powerpress - Cross-Site Scripting (XSS) (CVE-2026-2988)

The Blubrry PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'powerpress' and 'podcast' shortcodes in versions up to, and including, 11.15.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Powerpress

CVE-2026-2988

MEDIUM CVSS 6.4 2026-04-08
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Powerpress - Remote Code Execution (CVE-2025-13536)

The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 11.15.2. This is due to the plugin validating file extensions but not halting execution when validation fails in the 'powerpress_edit_post' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

PLUGIN Powerpress

CVE-2025-13536

HIGH CVSS 8.8 2025-11-27
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Powerpress - Cross-Site Scripting (XSS) (CVE-2024-9227)

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

PLUGIN Powerpress

CVE-2024-9227

MEDIUM CVSS 4.8 2025-05-15
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Powerpress - Cross-Site Scripting (XSS) (CVE-2024-9230)

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and above users to perform Stored Cross-Site Scripting attacks

PLUGIN Powerpress

CVE-2024-9230

MEDIUM CVSS 5.9 2025-04-14
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Powerpress - Cross-Site Scripting (XSS) (CVE-2024-9543)

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skipto' shortcode in all versions up to, and including, 11.9.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Powerpress

CVE-2024-9543

MEDIUM CVSS 6.4 2024-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Powerpress - Cross-Site Scripting (XSS) (CVE-2024-6588)

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘media_url’ parameter in all versions up to, and including, 11.9.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Powerpress

CVE-2024-6588

MEDIUM CVSS 6.4 2024-07-12
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Powerpress - Cross-Site Scripting (XSS) (CVE-2023-4820)

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.

PLUGIN Powerpress

CVE-2023-4820

MEDIUM CVSS 5.4 2023-10-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Powerpress - Cross-Site Scripting (XSS) (CVE-2023-1917)

The PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: A partial fix for the issue was introduced in version 10.0.1, and an additional patch (version 10.0.2) was released to address a workaround.

PLUGIN Powerpress

CVE-2023-1917

MEDIUM CVSS 5.4 2023-06-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Powerpress - Remote Code Execution (CVE-2021-24123)

Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast Artwork section), allowing high privilege accounts (admin+) being able to upload arbitrary files, such as php, leading to RCE.

PLUGIN Powerpress

CVE-2021-24123

HIGH CVSS 7.2 2021-03-18
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.