VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

PowerPress Podcasting plugin by Blubrry security & vulnerabilities

powerpress— active installsLast vulnerability Nov 12, 2026

No known unpatched vulnerabilities in the latest version

All 35 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
35Known vulnerabilities
  • Critical1
  • High4
  • Medium30
  • Low0
Vulnerabilities per year
2015: 2 vulnerabilities2152020: 1 vulnerability1202023: 5 vulnerabilities5232024: 3 vulnerabilities3242025: 8 vulnerabilities8252026: 16 vulnerabilities1626

All PowerPress Podcasting plugin by Blubrry vulnerabilities

PowerPress Podcasting plugin by Blubrry vulnerabilities
SeverityVulnerabilityCVEPublished
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes
≤11.18.0Update to 11.18.2
CVE-2026-118587
Medium4.3Missing Authorization
≤11.18.2Update to 11.18.3
CVE-2026-125782
Medium4.3Missing Authorization
≤11.18.0Update to 11.18.2
CVE-2026-121766
Medium4.3Cross-Site Request Forgery
≤11.18.0Update to 11.18.2
CVE-2026-121762
Medium5.3Missing Authorization
≤11.17.9Update to 11.17.11
CVE-2026-104387
Medium5.3Unauthenticated Information Exposure
≤11.17.9Update to 11.17.11
CVE-2026-104388
Medium4.3Cross-Site Request Forgery
≤11.17.9Update to 11.17.11
CVE-2026-104407
Medium6.411.17.9 - Authenticated (Contributor+) Server-Side Request Forgery
11.13.12 – 11.17.9Update to 11.17.11
CVE-2026-97354
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤11.17.1Update to 11.17.2
CVE-2026-97319
Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
<11.17.1Update to 11.17.1
CVE-2026-16294
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤11.16.10Update to 11.16.11
CVE-2026-16293
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta Field
≤11.16.8Update to 11.16.9
CVE-2026-12098
Medium6.5Authenticated (Contributor+) SQL Injection
≤11.15.10Update to 11.15.11
CVE-2026-24637
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via powerpress and podcast Shortcodes
≤11.15.15Update to 11.15.16
CVE-2026-2988
High7.5Authenticated (Contributor+) PHP Object Injection
≤11.15.10Update to 11.15.11
CVE-2026-23798
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤11.15.13Update to 11.15.14
CVE-2026-32351
High8.8Authenticated (Contributor+) Arbitrary File Upload via 'powerpress_edit_post'
≤11.15.2Update to 11.15.3
CVE-2025-13536
Medium4.3Cross-Site Request Forgery
≤11.13.12Update to 11.14
CVE-2025-64201
Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
≤11.13.11Update to 11.13.12
CVE-2025-49984
High8.8Authenticated (Contributor+) Stored Cross-Site Scripting
≤11.12.5Update to 11.12.6
CVE-2025-46264
Medium5.4Authenticated (Contributor+) Server-Side Request Forgery
≤11.12.6Update to 11.12.7
CVE-2025-32691
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤11.12.5Update to 11.12.6
CVE-2025-32690
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤11.9.17Update to 11.9.18
CVE-2024-9230
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤11.9.17Update to 11.9.18
CVE-2024-9227
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode
≤11.9.18Update to 11.9.19
CVE-2024-9543
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter
≤11.9.10Update to 11.9.11
CVE-2024-6588
Critical10.0Injected Backdoor
4.4.6.4 – 4.4.7.1Update to 4.4.7.3
CVE-2024-6297
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Media URL
<11.0.12Update to 11.0.12
CVE-2023-4820
Medium5.4Authenticated (Contributor+) Server-Side Request Forgery via wp_ajax_powerpress_media_info
≤11.0.6Update to 11.0.7
CVE-2023-41239
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Feed[title]'
≤10.2.3Update to 10.2.4
—
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤10.0.1Update to 10.0.2
CVE-2023-30778
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤10.0Update to 10.0.2
CVE-2023-1917
High7.2Arbitrary File Upload
≤8.3.7Update to 8.3.8
CVE-2021-24123
Medium6.1Reflected Cross-Site Scripting
≤6.0.4Update to 6.0.5
CVE-2015-9410
Medium6.1Cross-Site Scripting
≤6.0.0Update to 6.0.1
CVE-2015-1385

PowerPress Podcasting plugin by Blubrry: common questions

Does PowerPress Podcasting plugin by Blubrry have known vulnerabilities?

Yes. VulnCrest Radar lists 35 known vulnerabilities in PowerPress Podcasting plugin by Blubrry: 1 critical, 4 high, 30 medium. None are known to affect version null.

How do I check which version of PowerPress Podcasting plugin by Blubrry I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent PowerPress Podcasting plugin by Blubrry vulnerability?

CVE-2026-118587, published Nov 12, 2026: PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes. Severity: Medium (CVSS 5.4).

Is any PowerPress Podcasting plugin by Blubrry vulnerability listed in CISA KEV?

No. None of the known PowerPress Podcasting plugin by Blubrry vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?