CVE-2026-16293: Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL

Q: What is the severity of CVE-2026-16293?

CVE-2026-16293 has a risk rating of 37, indicating a moderate severity level.

Q: How do I fix CVE-2026-16293?

To fix CVE-2026-16293, update the Blubrry PowerPress Podcasting plugin to version 11.16.11 or later.

Q: What type of vulnerability is CVE-2026-16293?

CVE-2026-16293 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.

Q: Who is affected by CVE-2026-16293?

Users with a Contributor role in WordPress using the affected versions of the Blubrry PowerPress plugin are vulnerable to CVE-2026-16293.

Q: What can attackers do with CVE-2026-16293?

Attackers can exploit CVE-2026-16293 to execute malicious scripts on the browsers of users interacting with compromised podcast episode settings.

Published Aug 4, 2026

Updated

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed.

Affected Software

2 affected components

Blubrry PowerPress Podcasting plugin<11.16.11

Blubrry WordPress plugin<11.16.11

Event History

Aug 4, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2026-16293?

CVE-2026-16293 has a risk rating of 37, indicating a moderate severity level.

How do I fix CVE-2026-16293?

To fix CVE-2026-16293, update the Blubrry PowerPress Podcasting plugin to version 11.16.11 or later.

What type of vulnerability is CVE-2026-16293?

CVE-2026-16293 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.

Who is affected by CVE-2026-16293?

Users with a Contributor role in WordPress using the affected versions of the Blubrry PowerPress plugin are vulnerable to CVE-2026-16293.

What can attackers do with CVE-2026-16293?

Attackers can exploit CVE-2026-16293 to execute malicious scripts on the browsers of users interacting with compromised podcast episode settings.

CVE-2026-16293: Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-16293?

How do I fix CVE-2026-16293?

What type of vulnerability is CVE-2026-16293?

Who is affected by CVE-2026-16293?

What can attackers do with CVE-2026-16293?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-16293?

How do I fix CVE-2026-16293?

What type of vulnerability is CVE-2026-16293?

Who is affected by CVE-2026-16293?

What can attackers do with CVE-2026-16293?