All vulnerabilities
CVE-2026-97354

PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects

Unknown PowerPress Podcasting plugin by Blubrry
Open in ThreatlineRecord JSON
CVSS
4.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in11.17.11Fixed versionCVE List
Published7 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 11.17.11PowerPress Podcasting plugin by BlubrryCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.

Text from CVE List

Affected versions 1

  • PowerPress Podcasting plugin by Blubrryaffected: 11.13.12 before 11.17.11CVE List

References 1