CVE-2026-12098: PowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta Field
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed' Episode Meta Field in all versions up to, and including, 11.16.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The embed value is stored via updatepostmeta() rather than through WordPress core's post content pipeline, meaning kses-on-save filtering is never applied — even for Author-role users who would otherwise lack unfilteredhtml — making this path unprotected by WordPress's standard role-based XSS mitigations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
PowerPress Podcasting plugin by Blubrryfrom your environment.Uninstall or deactivate the PowerPress Podcasting plugin if it is not required.
- Compensating control
Limit exposure by restricting which accounts can hold Author-level or higher privileges. Remove Author+ privileges from untrusted users, require administrative approval for role changes, and restrict admin area access for Author+ users (for example via IP allowlisting, VPN, or network access controls).
- Operational
Search site post meta for the 'embed' Episode Meta Field values stored via update_post_meta and sanitize or remove any entries containing script tags or other suspicious content. Apply cleaning to existing stored meta to eliminate injected scripts.
- Operational
Audit recent edits and access logs for activity by Author+ users to detect potential exploitation. If malicious content or account compromise is found, remove injected content, remediate the accounts (password reset, MFA enrollment), and notify affected parties as appropriate.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12098?
CVE-2026-12098 has a medium severity score of 6.4.
How do I fix CVE-2026-12098?
To fix CVE-2026-12098, update the PowerPress Podcasting plugin to a version later than 11.16.8.
What type of vulnerability is CVE-2026-12098?
CVE-2026-12098 is classified as a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-12098?
Authenticated users with Author+ permissions on WordPress sites using the vulnerable version of the PowerPress Podcasting plugin are affected.
What causes the vulnerability in CVE-2026-12098?
The vulnerability in CVE-2026-12098 is caused by insufficient input sanitization and output escaping in the 'embed' Episode Meta Field.