CVE-2023-4820

PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS

Medium · published October 16, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
39.8
In the wild
Unconfirmed
What it is

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00471 · 39.8th percentile
Published
2023-10-16T19:39Z
EPSS history
Timeline
  • 16 OCT 19:39Z
    PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS
    cvelistv5