PT-2023-30725 · Blubrry · Powerpress Podcasting Plugin

Emad · Publicado 2023-10-16 · Atualizado 2025-03-05 · CVE-2023-4820

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PowerPress Podcasting plugin by Blubrry WordPress plugin versions prior to 11.0.12

Description The issue concerns the PowerPress Podcasting plugin by Blubrry WordPress plugin, where it does not properly sanitize and escape the media URL field in posts. This could allow users with privileges as low as contributor to inject arbitrary web scripts, potentially targeting a site admin or superadmin.

Recommendations For versions prior to 11.0.12, update to version 11.0.12 or later to resolve the issue. As a temporary workaround, consider restricting the ability of contributors to edit posts or limiting their access to the media URL field until the update is applied.

Exploit

Correção

Identificadores relacionados

CVE-2023-4820

Produtos afetados

Powerpress Podcasting Plugin

Referências · 7

• 🔥 https://wpscan.com/vulnerability/e866a214-a142-43c7-b93d-ff2301a3e432 · Exploit
• https://osv.dev/vulnerability/CVE-2023-4820 · Aviso do Fabricante
• https://t.me/cibsecurity/72356 · Publicação no Telegram
• https://t.me/cvenotify/113576 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1714006519342063821 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-4820 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1714060121498681844 · Publicação no Twitter