sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total26
Critical1
High6
Medium19
Reset
Showing 1-20 of 26 records
Threat Entry Updated 2026-11-07

Powerpress - Security Vulnerability (CVE-2026-121766)

Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPress Podcasting: from n/a through 11.18.0.

PLUGIN Powerpress

CVE-2026-121766

MEDIUM CVSS 5.4 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-06-18

Powerpress - Cross-Site Scripting (XSS) (CVE-2026-12098)

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed' Episode Meta Field in all versions up to, and including, 11.16.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The embed value is stored via update_post_meta() rather than through WordPress core's post content pipeline, meaning kses-on-save filtering is never applied — even for Author-role…

PLUGIN Powerpress

CVE-2026-12098

MEDIUM CVSS 6.4 2026-06-18
Open Full Technical Breakdown
Threat Entry Updated 2026-07-25

Powerpress - Cross-Site Scripting (XSS) (CVE-2026-2988)

The Blubrry PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'powerpress' and 'podcast' shortcodes in versions up to, and including, 11.15.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Powerpress

CVE-2026-2988

MEDIUM CVSS 6.4 2026-04-08
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Powerpress - Remote Code Execution (CVE-2025-13536)

The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 11.15.2. This is due to the plugin validating file extensions but not halting execution when validation fails in the 'powerpress_edit_post' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

PLUGIN Powerpress

CVE-2025-13536

HIGH CVSS 8.8 2025-11-27
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Powerpress - Cross-Site Scripting (XSS) (CVE-2024-9227)

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

PLUGIN Powerpress

CVE-2024-9227

MEDIUM CVSS 4.8 2025-05-15
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Powerpress - Cross-Site Scripting (XSS) (CVE-2024-9230)

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and above users to perform Stored Cross-Site Scripting attacks

PLUGIN Powerpress

CVE-2024-9230

MEDIUM CVSS 5.9 2025-04-14
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Powerpress - Cross-Site Scripting (XSS) (CVE-2024-9543)

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skipto' shortcode in all versions up to, and including, 11.9.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Powerpress

CVE-2024-9543

MEDIUM CVSS 6.4 2024-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Powerpress - Cross-Site Scripting (XSS) (CVE-2024-6588)

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘media_url’ parameter in all versions up to, and including, 11.9.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Powerpress

CVE-2024-6588

MEDIUM CVSS 6.4 2024-07-12
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.