# CVE-2026-16293: Blubrry PowerPress Stored XSS in Podcast Episode settings

Source: https://junglewise.ai/threats/cve-2026-16293-blubrry-powerpress-stored-xss-in-podcast-episode-settings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16293 · Severity: medium · CVSS 6.8 · Published 2026-08-04

Blubrry PowerPress is a WordPress plugin for managing and distributing podcasts. A flaw in how the plugin handles podcast episode metadata allows low-privileged users (Contributors) to inject malicious code into episode settings. When administrators or editors later review or publish these episodes, the injected code executes in their browsers with full site privileges, potentially leading to account compromise or unauthorized actions.

Vendors: [Blubrry](https://junglewise.ai/threats/vendors/blubrry).

## Quick answers

**Is CVE-2026-16293 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16293 being exploited in the wild.

**How severe is CVE-2026-16293?** Medium severity, with a CVSS score of 6.8, published 4 August 2026.

**Which products and versions are affected?** Blubrry PowerPress before 11.16.11.

**Is there a fix for CVE-2026-16293?** A patch was published on 2026-11-16: Version 11.16.11 includes the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16293 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16293?** Check whether you run Blubrry PowerPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in the PowerPress plugin's handling of Podcast Episode Chapters URL field. The vulnerable component fails to sanitize user input in the Chapters URL setting and subsequently renders it without proper HTML escaping when displaying the metabox. An attacker with Contributor role can inject JavaScript payloads via the "Chapters URL" field; the plugin stores the payload verbatim in post metadata and echoes it unescaped when an Editor or Administrator edits the post. The vulnerability bypasses WordPress's normal KSES filtering because the malicious data is stored outside the standard post content field. The flaw was fixed in version 11.16.11.

## Affected products

- Blubrry PowerPress before 11.16.11

## Timeline

- 2026-07-27: disclosed
- 2026-11-16: patched: Version 11.16.11 includes the fix
- 2026-08-04: advisory

## References

- [https://wpscan.com/vulnerability/04aa5ba8-2654-4e71-90af-83cfd92635f8/](https://wpscan.com/vulnerability/04aa5ba8-2654-4e71-90af-83cfd92635f8/)

## Related threats

- [Blubrry PowerPress server-side request forgery in Podcast Episode Chapters URL](https://junglewise.ai/threats/cve-2026-16294-blubrry-powerpress-server-side-request-forgery-in-podcast-episode)