Medium severity · published Aug 4, 2026
CVE-2026-16293
Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL
6.8
CVSS
0.4%
EPSS
No
On KEV
Description
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
PowerPress Podcasting plugin by Blubrry ·
before 11.16.11 · source: vendor
Affected product
PP
PowerPress Podcasting plugin by Blubrry
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16293
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16293
wpscan.com
https://wpscan.com/vulnerability/04aa5ba8-2654-4e71-90af-83cfd92635f8/
More from PowerPress Podcasting plugin by Blubrry
7.1
CVE-2026-16294
Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL
6.8
CVE-2026-97319
PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block
5.9
CVE-2024-9230
PowerPress Podcasting < 11.9.18 - Author+ XSS via Podcast URL
5.4
CVE-2023-4820
PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS
4.8
CVE-2024-9227
PowerPress Podcasting < 11.9.18 - Author+ XSS