Executive brief
The Blubrry PowerPress plugin for WordPress, which is used to manage and publish podcasts, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts into website pages. When other users or administrators visit these affected pages, the scripts will run automatically in their browsers. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.
Technical details
The Blubrry PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of user-supplied input within the 'powerpress' and 'podcast' shortcodes. The root cause is insufficient input sanitization and output escaping in versions up to and including 11.15.15. An authenticated attacker with at least contributor-level permissions can exploit this by embedding malicious web scripts into posts or pages via these shortcodes. Because the scripts are stored on the server, they execute in the context of any user's browser who views the affected content. A patch was introduced in changeset 3473781 to address these sanitization issues.
Affected products
- Blubrry PowerPress Podcasting plugin by Blubrry <= 11.15.15
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory