CVE-2023-4820: PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS
Published Oct 16, 2023
·Updated
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.
Affected Software
1 affected component
Blubrry Powerpress Wordpress<11.0.12
Event History
Oct 16, 2023
CVE Published
via MITRE·07:39 PM
Data Sourced
via MITRE·07:39 PM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for the PowerPress Podcasting plugin?
The vulnerability ID for the PowerPress Podcasting plugin is CVE-2023-4820.
2
What is the severity of CVE-2023-4820?
The severity of CVE-2023-4820 is medium (5.4).
3
What does the PowerPress Podcasting plugin vulnerability allow?
The PowerPress Podcasting plugin vulnerability allows users with low privileges to inject arbitrary web scripts.
4
How does CVE-2023-4820 impact WordPress sites?
CVE-2023-4820 impacts WordPress sites by potentially allowing users to inject malicious scripts.
5
How can I fix the PowerPress Podcasting plugin vulnerability?
To fix the PowerPress Podcasting plugin vulnerability, update to version 11.0.12 or higher.