All vulnerabilities
CVE-2026-97319

PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block

Unknown PowerPress Podcasting plugin by Blubrry
Open in ThreatlineRecord JSON
CVSS
6.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in11.17.2Fixed versionCVE List
Published27 Sep 2026Updated 28 Sep 2026CVE List

What fixes it

  • 11.17.2PowerPress Podcasting plugin by BlubrryCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Text from CVE List

Affected versions 1

  • PowerPress Podcasting plugin by Blubrryaffected: all versions before 11.17.2CVE List

References 1