CVE-2026-118587
Deferred Deferred - Pending Action

Stored XSS in PowerPress Podcasting WordPress Plugin

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: Wordfence

Description
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the site's configured video player is set to html5video, or when the media URL uses a .webm or .ogv extension, as these conditions are required to route the shortcode attributes through the vulnerable powerpressplayer_build_html5video() builder. Successful exploitation additionally requires an action by an editor — the attacker cannot trigger the vulnerability on their own.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-118587
EUVD
EUVD-2026-124999

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
blubrry PowerPress Podcasting plugin by Blubrry From 0 (inc) to 11.18.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The PowerPress Podcasting plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability in versions up to 11.18.0. It occurs due to insufficient input sanitization and output escaping in the 'width' parameter. Authenticated attackers with contributor-level access or higher can inject malicious scripts into pages. These scripts execute when users visit the affected pages.

Impact Analysis

An attacker could steal user sessions, redirect users to malicious sites, or perform actions on their behalf. The impact depends on user privileges. If the site uses the html5video player or media URLs with .webm/.ogv extensions, the risk increases as these conditions enable exploitation.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Update the PowerPress Podcasting plugin by Blubrry to the latest version beyond 11.18.0 to patch the vulnerability. Disable the html5video player setting if not required. Review user roles and restrict contributor-level access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...