Executive brief
The PowerPress Podcasting plugin for WordPress is vulnerable to a security flaw that allows users with author-level permissions to inject malicious scripts into website pages. This occurs through the podcast episode 'embed' field, which fails to properly clean user input. If exploited, an attacker could execute code in the browsers of other site visitors, potentially leading to unauthorized actions or data theft.
Technical details
The PowerPress Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'embed' Episode Meta Field. The vulnerability exists because the plugin uses update_post_meta() to store the embed value directly, bypassing the standard WordPress post content pipeline and its associated kses-on-save filtering. This allows authenticated attackers with Author-level privileges or higher—who typically lack the 'unfiltered_html' capability—to inject malicious scripts. These scripts are then executed in the context of any user who views the affected podcast episode page. The issue is present in all versions up to and including 11.16.8.
Affected products
- Blubrry PowerPress Podcasting plugin by Blubrry <= 11.16.8
Timeline
- 2026-06-18: disclosed
- 2026-06-18: advisory
References
- https://plugins.trac.wordpress.org/browser/powerpress/tags/11.16.4/powerpress.php
- https://plugins.trac.wordpress.org/browser/powerpress/tags/11.16.4/powerpress.php
- https://plugins.trac.wordpress.org/browser/powerpress/tags/11.16.4/powerpressadmin.php
- https://plugins.trac.wordpress.org/browser/powerpress/tags/11.16.8/powerpress.php
- https://plugins.trac.wordpress.org/browser/powerpress/tags/11.16.8/powerpress.php
- https://plugins.trac.wordpress.org/browser/powerpress/tags/11.16.8/powerpressadmin.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3575897%40powerpress&new=3575897%40powerpress&sfp_email=&sfph_mail=