CVE-2026-16293 — Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL

CVE-2026-16293

Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL PUBLISHED

Description (CNA)

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Affected (CNA)

Vendor / product	Versions
Unknown / PowerPress Podcasting plugin by Blubrry	affected 0 before 11.16.11

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/04aa5ba8-2654-4e71-90af-83cfd92635f8/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.