Unscored severity · published Feb 2, 2015
CVE-2015-1385
Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via…
–
CVSS
2.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmin_categoryfeeds.php page to wp-admin/admin.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Powerpress · Blubrry
through 6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1385
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1385
Exploit
http://packetstormsecurity.com/files/130155/Blubrry-PowerPress-6.0-Cross-Site-Scripting.html
Exploit
http://seclists.org/fulldisclosure/2015/Jan/130
www.securityfocus.com
http://www.securityfocus.com/archive/1/534577/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/72362
Vendor Advisory
https://wordpress.org/plugins/powerpress/changelog/
Exploit
https://www.netsparker.com/cve-2015-1385-xss-vulnerability-in-blubrry-powerpress/
More from Powerpress
7.2
CVE-2021-24123
Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast Artwork section),…
6.5
CVE-2023-41239
WordPress PowerPress Podcasting Plugin <= 11.0.6 is vulnerable to Server Side Request Forgery (SSRF)
5.9
CVE-2024-9230
PowerPress Podcasting < 11.9.18 - Author+ XSS via Podcast URL
5.4
CVE-2023-4820
PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS
5.4
CVE-2023-30778
WordPress PowerPress Podcasting Plugin <= 10.0.1 is vulnerable to Cross Site Scripting (XSS)