CVE-2023-4820
PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS
- State
- Published
- Severity
- 5.4 Medium
- Published
- Oct 16, 2023
- Updated
- Mar 5, 2025
- Reserved
- Sep 7, 2023
Description
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
PowerPress Podcasting plugin by BlubrryUnknown |
|
References
- https://wpscan.com/vulnerability/e866a214-a142-43c7-b93d-ff2301a3e432exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.