PowerPress < 10.0.2 - Contributor+ Stored Cross-Site Scripting

The plugin does not properly sanitize and escape user-supplied attributes in its shortcodes, leading to a Stored Cross-Site Scripting vulnerability...

WordPress PowerPress Podcasting plugin <= 8.6.1 - Multiple Authenticated Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Cross-Site Scripting XSS vulnerabilities discovered by Lenon Leite in the WordPress PowerPress Podcasting plugin versions = 8.6.1. Solution Update the WordPress PowerPress Podcasting plugin to the latest available version at least 8.6.2...

CVE-2021-24123

Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images such as the ones from Podcast Artwork section, allowing high privilege accounts admin+ being able to upload arbitrary files, such as php, leading to RCE...

CVE-2021-24123

Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images such as the ones from Podcast Artwork section, allowing high privilege accounts admin+ being able to upload arbitrary files, such as php, leading to RCE...

CVE-2021-24123

Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images such as the ones from Podcast Artwork section, allowing high privilege accounts admin+ being able to upload arbitrary files, such as php, leading to RCE...

CVE-2021-24123 PowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCE

Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images such as the ones from Podcast Artwork section, allowing high privilege accounts admin+ being able to upload arbitrary files, such as php, leading to RCE...

CVE-2021-24123

CVE-2021-24123 affects the PowerPress WordPress plugin prior to version 8.3.8. The vulnerability arises from insufficient verification of certain uploaded feed images (e.g., Podcast Artwork), enabling an authenticated attacker with admin+ privileges to upload arbitrary files (for example PHP file...

Wordpress PowerPress 代码问题漏洞

Wordpress PowerPress is Wordpress open source an application plugin . Provides a blog plugin functionality. WordPress PowerPress plugin before 8.3.8 A code issue vulnerability exists that allows arbitrary file uploads...

XSS Vulnerability in WordPress PowerPress Plugin

WordPress is the WordPress Wordpress Foundation's set of blogging platform developed using the PHP language.PowerPress is the WordPress plugin. An XSS vulnerability exists in the WordPress PowerPress plugin. An attacker can exploit the vulnerability to obtain an administrator cookie...

PowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCE

The plugin did not verify some of the uploaded feed images such as the ones from Podcast Artwork section, allowing high privilege accounts admin+ being able to upload arbitrary files, such as php, leading to RCE. https://drive.google.com/file/d/1fyf6blzeG3VX22BQX7hc1QJ20rCY5p43/view?usp=sharing -...

PowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCE

The plugin did not verify some of the uploaded feed images such as the ones from Podcast Artwork section, allowing high privilege accounts admin+ being able to upload arbitrary files, such as php, leading to RCE. PoC https://drive.google.com/file/d/1fyf6blzeG3VX22BQX7hc1QJ20rCY5p43/view?usp=shari...

WordPress PowerPress Podcasting plugin <= 8.3.7 - Authenticated Arbitrary File Upload leading to Remote Code Execution (RCE) vulnerability

Authenticated Arbitrary File Upload leading to Remote Code Execution RCE vulnerability found by Minh Tuan SunCSR in WordPress PowerPress Podcasting plugin versions = 8.3.7. Solution Update the WordPress PowerPress Podcasting plugin by Blubrry to the latest available version at least 8.3.8...

WordPress Blubrry PowerPress Podcasting Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Blubrry PowerPress Podcasting is used in one of the weblog features to build plug-ins. A cross-site scripting vulnerability exists ...

CVE-2015-9410

The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter...

Design/Logic Flaw

The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter...

CVE-2015-9410

The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter...

CVE-2015-9410

Summary: CVE-2015-9410 affects the Blubrry PowerPress Podcasting plugin for WordPress (version 6.0.4) with a Cross-Site Scripting (XSS) vulnerability exploitable via the tab parameter. Technical details across connected sources confirm an authenticated XSS path, with PoC instructions showing how ...

PT-2019-7369 · Blubrry · Blubrry Powerpress Podcasting Plugin

Name of the Vulnerable Software and Affected Versions: Blubrry PowerPress Podcasting plugin version 6.0.4 Description: The issue is related to a cross-site scripting XSS vulnerability. It occurs via the tab parameter. There is no information provided about the estimated number of potentially...

WordPress Blubrry PowerPress Podcasting Plugin <= 6.0.4 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Upgrade the plugin...

PowerPress Podcasting < 6.0.5 - Authenticated Cross-Site Scripting (XSS)

By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged in user’s session by stealing cookies. This means that the malicious hacker can change the logged in user’s password and invalidate the session of the victim while the hacker maintains access. 1. Logon into any...