CVE-2026-16294 Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target...

CVE-2026-16293

The CVE concerns the PowerPress Podcasting plugin for WordPress by Blubrry, affected in versions prior to 11.16.11. The underlying issue is improper sanitization/escaping of certain Podcast Episode settings, enabling Stored Cross-Site Scripting by a user with Contributor+ privileges even if unfil...

CVE-2026-16293 Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...