Executive brief
Blubrry PowerPress is a WordPress plugin for managing and distributing podcasts. A flaw in how the plugin handles podcast episode metadata allows low-privileged users (Contributors) to inject malicious code into episode settings. When administrators or editors later review or publish these episodes, the injected code executes in their browsers with full site privileges, potentially leading to account compromise or unauthorized actions.
Technical details
This is a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in the PowerPress plugin's handling of Podcast Episode Chapters URL field. The vulnerable component fails to sanitize user input in the Chapters URL setting and subsequently renders it without proper HTML escaping when displaying the metabox. An attacker with Contributor role can inject JavaScript payloads via the "Chapters URL" field; the plugin stores the payload verbatim in post metadata and echoes it unescaped when an Editor or Administrator edits the post. The vulnerability bypasses WordPress's normal KSES filtering because the malicious data is stored outside the standard post content field. The flaw was fixed in version 11.16.11.
Affected products
- Blubrry PowerPress before 11.16.11
Timeline
- 2026-07-27: disclosed
- 2026-11-16: patched: Version 11.16.11 includes the fix
- 2026-08-04: advisory