CVE-2026-118587: PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the site's configured video player is set to html5video, or when the media URL uses a .webm or .ogv extension, as these conditions are required to route the shortcode attributes through the vulnerable powerpressplayerbuildhtml5video() builder. Successful exploitation additionally requires an action by an editor — the attacker cannot trigger the vulnerability on their own.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
A site is exposed only if it runs an affected version through 11.18.0 and either has its configured video player set to html5video or processes media URLs ending in .webm or .ogv. The vulnerable shortcode path is not reached under the other stated conditions.
What level of access and interaction does an attacker need?
An attacker needs an authenticated WordPress account with Contributor-level access or higher and must be able to submit shortcode attributes. An editor must subsequently take an action; the attacker cannot trigger the issue alone.
What is the practical impact after a successful injection?
Arbitrary web scripts can be stored in an injected page and execute when a user accesses that page. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.