WordPress Plugin Vulnerabilities

Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL

Description

The plugin does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Proof of Concept

Affects Plugins

Plugin icon
powerpress
Fixed in 11.16.11

References

CVE
CVE-2026-16293

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Meher Sudhakar Abbireddi
Submitter
Meher Sudhakar Abbireddi
Verified
Yes
WPVDB ID
04aa5ba8-2654-4e71-90af-83cfd92635f8

Timeline

Publicly Published
2026-07-27 (about 8 days ago)
Added
2026-07-27 (about 7 days ago)
Last Updated
2026-07-27 (about 7 days ago)

Other

Published
Title
Published
2025-02-24
Title
WP Social SEO Booster – Knowledge Graph Social Signals SEO <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-06-06
Title
Comments – wpDiscuz < 7.6.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-06-25
Title
Exclusive Addons for Elementor < 2.6.9.9 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget
Published
2024-07-16
Title
Ultimate Addons for WPBakery Page Builder < 3.19.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2026-07-28
Title
Cozy Blocks < 2.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute