{
 "id": "WPSEC-2026-2499",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2499/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2499/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2499/index.md",
 "title": "PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes and Media URL",
 "description": "The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'powerpress' shortcode's 'url', 'width' and 'height' attributes and episode media URLs in all versions up to, and including, 11.18.0. This is due to these values being placed inside JavaScript strings in onclick handlers and inline autoplay scripts of the HTML5 audio and video players with only htmlspecialchars() escaping, which does not protect a JavaScript context. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The HTML5 audio/video players are not the default player, so the site has to be set up to use them for the media type.",
 "plugin": {
  "slug": "powerpress",
  "name": "PowerPress Podcasting plugin by Blubrry",
  "full_name": "PowerPress Podcasting plugin by Blubrry",
  "wordpress_org": "https://wordpress.org/plugins/powerpress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/powerpress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/powerpress"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "11.18.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 11.18.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "11.18.2",
 "remediation": "Update to 11.18.2 or later.",
 "fix_released": "2026-11-03T15:11:39+00:00",
 "published": "2026-11-04T15:47:10+00:00",
 "updated": "2026-11-04T13:58:21.398921+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2499/",
  "https://plugins.svn.wordpress.org/powerpress/tags/11.18.2/",
  "https://wordpress.org/plugins/powerpress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/powerpress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}