CVE-2026-16293: Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16293?
CVE-2026-16293 has a risk rating of 37, indicating a moderate severity level.
How do I fix CVE-2026-16293?
To fix CVE-2026-16293, update the Blubrry PowerPress Podcasting plugin to version 11.16.11 or later.
What type of vulnerability is CVE-2026-16293?
CVE-2026-16293 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-16293?
Users with a Contributor role in WordPress using the affected versions of the Blubrry PowerPress plugin are vulnerable to CVE-2026-16293.
What can attackers do with CVE-2026-16293?
Attackers can exploit CVE-2026-16293 to execute malicious scripts on the browsers of users interacting with compromised podcast episode settings.