Medium severity · published Oct 16, 2023
CVE-2023-4820
PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
PowerPress Podcasting plugin by Blubrry ·
before 11.0.12 · source: vendor
PO
Powerpress · Blubrry
before 11.0.12 · source: NVD
Affected product
PP
PowerPress Podcasting plugin by Blubrry
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4820
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4820
Exploit
https://wpscan.com/vulnerability/e866a214-a142-43c7-b93d-ff2301a3e432
More from PowerPress Podcasting plugin by Blubrry
7.1
CVE-2026-16294
Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL
6.8
CVE-2026-97319
PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block
6.8
CVE-2026-16293
Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL
5.9
CVE-2024-9230
PowerPress Podcasting < 11.9.18 - Author+ XSS via Podcast URL
4.8
CVE-2024-9227
PowerPress Podcasting < 11.9.18 - Author+ XSS