PowerPress <= 11.17.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Player Settings
- ID
- WPSEC-2026-0329
- Plugin
- PowerPress Podcasting plugin by Blubrry (powerpress)
- Affected
- all versions before 11.17.11
- Remediation
- Update to 11.17.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- PowerPress on WPSec AttackSurface
- Fix released
- Published
Description
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 11.17.9. This is due to missing nonce validation on the 'powerpress-select-player' and 'powerpress_bplayer' player settings actions, which save submitted values into the plugin's general settings, combined with insufficient escaping of the new-window player width and height settings on output. This makes it possible for unauthenticated attackers to change the plugin's settings and inject arbitrary web scripts that execute on the site's front-end pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References
- https://wpsec.com/vuln/WPSEC-2026-0329/
- https://plugins.svn.wordpress.org/powerpress/tags/11.17.11/
- https://wordpress.org/plugins/powerpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS