CVE-2023-4820: PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-10-16 · updated 2026-06-17

Description

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.

Affected products

PowerPress Podcasting plugin by Blubrry: before 11.0.12 — fixed in 11.0.12

How to fix

Upgrade to a fixed version: PowerPress Podcasting plugin by Blubrry 11.0.12. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/e866a214-a142-43c7-b93d-ff2301a3e432
https://wpscan.com/vulnerability/e866a214-a142-43c7-b93d-ff2301a3e432

Get alerted when CVE-2023-4820 or the next vulnerability affects your stack