Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: blubrry Component: Powerpress Clear all filters
TI-2024-08563 CVE-2024-9227 · GHSA-phhw-fr9r-6qv9

PowerPress Podcasting < 11.9.18 - Author+ XSS

Priority MEDIUM 55

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users to perform Stored Cross-Site Scripting at…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00326 Published 2025-05-15 Fixed in 11.9.18 CWE-79
TI-2024-08566 CVE-2024-9230 · GHSA-5q67-5hpv-7q5r

PowerPress Podcasting < 11.9.18 - Author+ XSS via Podcast URL

Priority MEDIUM 60

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and above users to perform Stored Cross-Site S…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00273 Published 2025-04-14 Fixed in 11.9.18 CWE-79
TI-2023-04437 CVE-2023-4820 · GHSA-hfr4-7364-jv2q

PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS

Priority MEDIUM 58

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00471 Published 2023-10-16 Fixed in 11.0.12
TI-2023-01801 CVE-2023-1917 · GHSA-pprf-mh8g-67wh

PowerPress <= 10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 25

The PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 10.0 due to insufficient input sanitization and output escaping on user sup…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00529 Published 2023-06-09 No fix listed CWE-79
TI-2021-06415 CVE-2021-24123 · GHSA-7cm9-xr5m-957v

PowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCE

Priority LOW 35

Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast Artwork section), allowing high privilege accounts (admin+)…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01647 Published 2021-03-18 Fixed in 8.3.8 CWE-434