Server side request forgery (ssrf)

Server-Side Request Forgery SSRF vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry.This issue affects PowerPress Podcasting plugin by Blubrry: from n/a through 11.0.6...

CVE-2023-41239 WordPress PowerPress Podcasting Plugin <= 11.0.6 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry.This issue affects PowerPress Podcasting plugin by Blubrry: from n/a through 11.0.6...

CVE-2023-41239

PowerPress Plugin by Blubrry (CVE-2023-41239) is affected by an authenticated SSRF via the powerpress_media_info AJAX action. The issue affects PowerPress versions up to 11.0.6 and is mitigated by upgrading to 11.0.7. Exploitation requires at least Contributor-level access (Authenticated), with t...

CVE-2023-41239 WordPress PowerPress Podcasting Plugin <= 11.0.6 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry.This issue affects PowerPress Podcasting plugin by Blubrry: from n/a through 11.0.6...

PowerPress Podcasting < 11.0.7 - Contributor+ SSRF

Description The plugin does not validate a parameter before making a request to it via the powerpressmediainfo AJAX action, which could allow Contributor and above role to perform SSRF attacks...

Buzzsprout Podcasting < 1.8.5 - Contributor+ Stored Cross-Site Scripting

Description The plugin does not adequately sanitize and escape user-supplied attributes in the 'buzzsprout' shortcode, which leads to a potential Stored Cross-Site Scripting vulnerability. This issue can result in the injection of arbitrary web scripts into pages, which are then executed when a...

CVE-2023-5335

The Buzzsprout Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buzzsprout' shortcode in versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

Cross site scripting

The Buzzsprout Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buzzsprout' shortcode in versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2023-5335 Buzzsprout Podcasting <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Buzzsprout Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buzzsprout' shortcode in versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2023-5335

CVE-2023-5335 : Buzzsprout Podcasting plugin for WordPress is vulnerable to stored XSS through the buzzsprout shortcode due to insufficient input sanitization and output escaping for shortcode attributes. Exploitation requires authenticated access at contributor level or higher, enabling an attac...

CVE-2023-5335 Buzzsprout Podcasting <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Buzzsprout Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buzzsprout' shortcode in versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

WordPress Plugin Buzzsprout Podcasting Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress Buzzsprout Podcasting Plugin <= 1.8.4 is vulnerable to Cross Site Scripting (XSS)

Software Buzzsprout Podcasting Type Plugin Vulnerable versions = 1.8.4 Fixed in 1.8.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5335 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7e90d34c0a34 Credits István Márton...

WordPress PowerPress Podcasting Plugin < 11.0.12 is vulnerable to Cross Site Scripting (XSS)

Software PowerPress Podcasting Type Plugin Vulnerable versions 11.0.12 Fixed in 11.0.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4820 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 083d4289c26f Credits emad Required...

CVE-2023-4820

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin...

Code injection

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin...

CVE-2023-4820

CVE-2023-4820 affects the PowerPress Podcasting plugin for WordPress (Blubrry) prior to version 11.0.12. The issue is that the plugin does not sanitize/escape the media URL field in posts, enabling stored cross-site scripting when a user with as little as contributor privileges posts content. The...

CVE-2023-4820 PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin...

CVE-2023-4820 PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin...

WordPress plugin PowerPress Podcasting plugin by Blubrry Cross-site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin PowerPress Podcasting plug...