7.1
High
CVE-2026-16294 The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode…
Description
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| PowerPress Podcasting plugin by Blubrry 11.17 | earliest → < 11.17.1 | 11.17.1 |
Other CVEs of PowerPress Podcasting plugin by Blubrry
The 7 CVEs of PowerPress Podcasting plugin by Blubrry →
CVE-2026-97354
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of…
4.1
Medium
CVE-2026-97319
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block…
6.8
Medium
CVE-2026-16293
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its…
6.8
Medium
CVE-2024-9227
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its…
4.8
Medium