CVE-2026-16293
Received Received - Intake

Stored Cross-Site Scripting in PowerPress Podcasting WordPress Plugin

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: WPScan

Description
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-16293
EUVD
EUVD-2026-52596

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
blubrry powerpress to 11.16.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The PowerPress Podcasting plugin by Blubrry for WordPress before version 11.16.11 has a vulnerability where it does not properly sanitize and escape certain Podcast Episode settings. This flaw allows users with Contributor-level access to inject malicious scripts that are stored and executed when others view the affected pages.

Detection Guidance

To detect this vulnerability, check if the PowerPress Podcasting plugin version is below 11.16.11. Use WordPress admin panel or run commands like 'wp plugin list' in WP-CLI to verify the installed version.

Impact Analysis

If exploited, this vulnerability could allow attackers to steal sensitive data, hijack user sessions, or deface your website. It specifically targets users with Contributor roles, enabling them to escalate privileges or compromise visitors through stored scripts.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR by exposing personal data or HIPAA by compromising protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the PowerPress Podcasting plugin to version 11.16.11 or later immediately. Remove or restrict user roles with Contributor access if unfiltered_html capability is disabled to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16293. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart