WordPress Plugin Vulnerabilities

PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block

Description

The plugin does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
powerpress
Fixed in 11.17.2

References

CVE
CVE-2026-97319

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://research.cleantalk.org
Verified
Yes
WPVDB ID
6ea7d2b5-8406-4efe-9b61-465af40d9a32

Timeline

Publicly Published
2026-09-25 (about 2 days ago)
Added
2026-09-25 (about 1 day ago)
Last Updated
2026-09-25 (about 1 day ago)

Other

Published
Title
Published
2020-09-09
Title
Elementor Addon Elements < 1.6.4 - CSRF & XSS
Published
2025-03-24
Title
Secret Meta <= 1.2.1 - Reflected Cross-Site Scripting
Published
2021-11-02
Title
Ivory Search < 4.8 - Contributor+ Stored Cross-Site Scripting
Published
2015-08-26
Title
Role Scoper <= 1.3.64 - Authenticated Reflected Cross-Site Scripting (XSS)
Published
2026-03-27
Title
Quads Ads Manager for Google AdSense < 2.0.99 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Ad Metadata Parameters