What’s Vulnerable › Products
PowerPress Podcasting plugin by Blubrry vulnerabilities
18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.
Check whether your PowerPress Podcasting plugin by Blubrry version is affected
Latest PowerPress Podcasting plugin by Blubrry vulnerabilities
- CVE-2026-97354 — PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects (CVSS 4.1)
- CVE-2026-97319 — PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block (CVSS 6.8)
- CVE-2026-16294 — Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL (CVSS 7.1)
- CVE-2026-16293 — Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL (CVSS 6.8)
- CVE-2026-12098 — PowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta Field (CVSS 6.4)
- CVE-2026-2988 — Blubrry PowerPress <= 11.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via powerpress and podcast Shortcodes (CVSS 6.4)
- CVE-2025-13536 — Blubrry PowerPress <= 11.15.2 - Authenticated (Contributor+) Arbitrary File Upload via 'powerpress_edit_post' (CVSS 8.8)
- CVE-2024-9227 — PowerPress Podcasting < 11.9.18 - Author+ XSS (CVSS 4.8)
- CVE-2024-9230 — PowerPress Podcasting < 11.9.18 - Author+ XSS via Podcast URL (CVSS 5.9)
- CVE-2024-9543 — Powerpress <= 11.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode (CVSS 6.4)
- CVE-2024-6588 — PowerPress Podcasting plugin by Blubrry <= 11.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter (CVSS 6.4)
- CVE-2023-41239 — WordPress PowerPress Podcasting Plugin <= 11.0.6 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 6.5)
- CVE-2023-4820 — PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS (CVSS 5.4)
- CVE-2023-30778 — WordPress PowerPress Podcasting Plugin <= 10.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
- CVE-2023-1917 — PowerPress <= 10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
- CVE-2021-24123 — PowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCE (CVSS 7.2)
- CVE-2015-9410 — (CVSS 5.4)
- CVE-2015-1385 — (CVSS 4.3)