CVE-2026-16293

CVE-2026-16293 affects the Blubrry PowerPress WordPress plugin prior to version 11.16.11. The issue is a Stored XSS in Podcast Episode settings due to insufficient sanitisation/escaping, allowing low-privilege users (Contributor) to inject scripts even when unfiltered_html is disallowed. Vulnerab...

CVE-2026-16293 Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...