CVE-2026-97319— PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block
Quick assessment
Affected
Unknown PowerPress Podcasting plugin by Blubrry
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Blubrry 开发的 PowerPress Podcasting 插件在版本 11.17.2 之前，未在将区块属性输出到页面之前对其进行 sanitize（清洗）和 escape（转义），这可能导致具有贡献者（contributor）及以上角色的用户执行存储型跨站脚本（Stored XSS）攻击。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97319
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block
Source: CVE Program / CVE List V5
Vulnerability Description
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | PowerPress Podcasting plugin by Blubrry | 0 ~ 11.17.2 | - |
|
II. Public POCs for CVE-2026-97319
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97319
请登录查看更多情报信息。
Other References for CVE-2026-97319 (1)
-
https://wpscan.com/vulnerability/6ea7d2b5-8406-4efe-9b61-465af40d9a32/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-27 · 19 CVEs total
| CVE-2026-89003 | WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview | |
| CVE-2026-84069 | WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php | |
| CVE-2026-81655 | Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields | |
| CVE-2026-82841 | UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migrati | |
| CVE-2026-85002 | EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes | |
| CVE-2026-86609 | Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription | |
| CVE-2026-86839 | Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via I | |
| CVE-2026-86841 | Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced O | |
| CVE-2026-89001 | WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing vi | |
| CVE-2026-96899 | Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script | |
| CVE-2026-89006 | WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import | |
| CVE-2026-89000 | WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run | |
| CVE-2026-96896 | Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deleti | |
| CVE-2026-96897 | Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Passw | |
| CVE-2026-96895 | WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes | |
| CVE-2026-92995 | Verge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_file | |
| CVE-2026-92436 | Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via I | |
| CVE-2026-97227 | NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential |
IV. Related Vulnerabilities
Same product: PowerPress Podcasting plugin by Blubrry
-
CVE-2026-16294
Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Requ -
CVE-2026-16293
Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via -
CVE-2026-12098
PowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authent -
CVE-2026-2988
Blubrry PowerPress <= 11.15.15 - Authenticated (Contributor+ -
CVE-2025-13536
Blubrry PowerPress <= 11.15.2 - Authenticated (Contributor+)
Same vendor: Unknown
-
CVE-2026-92996
Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via -
CVE-2026-89411
Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbo -
CVE-2026-86838
Bookly < 28.3 - Unauthenticated Payment Bypass via Booking P -
CVE-2026-88828
Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked Us -
CVE-2026-84744
WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Sho
V. Comments for CVE-2026-97319
No comments yet