Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-13
PowerPress Podcasting plugin by Blubrry - Security Vulnerability (CVE-2026-118587)
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the site's configured video player is set to html5video, or when the media URL uses a .webm or .ogv extension,…
PLUGIN
PowerPress Podcasting plugin by Blubrry
CVE-2026-118587
Risk Score
Threat Entry
Updated 2026-10-07
PowerPress Podcasting plugin by Blubrry - Security Vulnerability (CVE-2026-97354)
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.
PLUGIN
PowerPress Podcasting plugin by Blubrry
CVE-2026-97354
Risk Score
Threat Entry
Updated 2026-09-28
PowerPress Podcasting plugin by Blubrry - Security Vulnerability (CVE-2026-97319)
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
PowerPress Podcasting plugin by Blubrry
CVE-2026-97319
Risk Score
Threat Entry
Updated 2026-08-26
PowerPress Podcasting plugin by Blubrry - Server-Side Request Forgery (SSRF) (CVE-2026-16294)
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.
PLUGIN
PowerPress Podcasting plugin by Blubrry
CVE-2026-16294
Risk Score
Threat Entry
Updated 2026-08-26
PowerPress Podcasting plugin by Blubrry - Cross-Site Scripting (XSS) (CVE-2026-16293)
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
PowerPress Podcasting plugin by Blubrry
CVE-2026-16293
Risk Score
Threat Entry
Updated 2026-06-18
PowerPress Podcasting plugin by Blubrry - Cross-Site Scripting (XSS) (CVE-2026-12098)
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed' Episode Meta Field in all versions up to, and including, 11.16.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The embed value is stored via update_post_meta() rather than through WordPress core's post content pipeline, meaning kses-on-save filtering is never applied — even for Author-role…
PLUGIN
PowerPress Podcasting plugin by Blubrry
CVE-2026-12098
Risk Score
Threat Entry
Updated 2026-07-25
PowerPress Podcasting plugin by Blubrry - Cross-Site Scripting (XSS) (CVE-2026-2988)
The Blubrry PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'powerpress' and 'podcast' shortcodes in versions up to, and including, 11.15.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
PowerPress Podcasting plugin by Blubrry
CVE-2026-2988
Risk Score
Threat Entry
Updated 2026-06-17
PowerPress Podcasting plugin by Blubrry - Cross-Site Scripting (XSS) (CVE-2024-9227)
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
PowerPress Podcasting plugin by Blubrry
CVE-2024-9227
Risk Score
Threat Entry
Updated 2026-06-17
PowerPress Podcasting plugin by Blubrry - Cross-Site Scripting (XSS) (CVE-2024-9230)
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and above users to perform Stored Cross-Site Scripting attacks
PLUGIN
PowerPress Podcasting plugin by Blubrry
CVE-2024-9230
Risk Score
Threat Entry
Updated 2026-06-17
PowerPress Podcasting plugin by Blubrry - Cross-Site Scripting (XSS) (CVE-2024-9543)
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skipto' shortcode in all versions up to, and including, 11.9.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
PowerPress Podcasting plugin by Blubrry
CVE-2024-9543
Risk Score
Threat Entry
Updated 2026-06-17
PowerPress Podcasting plugin by Blubrry - Cross-Site Scripting (XSS) (CVE-2024-6588)
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘media_url’ parameter in all versions up to, and including, 11.9.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
PowerPress Podcasting plugin by Blubrry
CVE-2024-6588
Risk Score
Threat Entry
Updated 2026-06-17
PowerPress Podcasting plugin by Blubrry - Cross-Site Scripting (XSS) (CVE-2023-4820)
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.
PLUGIN
PowerPress Podcasting plugin by Blubrry
CVE-2023-4820
Risk Score