PT-2023-30725 · Blubrry · Powerpress Podcasting Plugin

Emad · Published 2023-10-16 · Updated 2025-03-05 · CVE-2023-4820

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PowerPress Podcasting plugin by Blubrry WordPress plugin versions prior to 11.0.12

Description The issue concerns the PowerPress Podcasting plugin by Blubrry WordPress plugin, where it does not properly sanitize and escape the media URL field in posts. This could allow users with privileges as low as contributor to inject arbitrary web scripts, potentially targeting a site admin or superadmin.

Recommendations For versions prior to 11.0.12, update to version 11.0.12 or later to resolve the issue. As a temporary workaround, consider restricting the ability of contributors to edit posts or limiting their access to the media URL field until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2023-4820

Affected Products

Powerpress Podcasting Plugin

References · 7

• 🔥 https://wpscan.com/vulnerability/e866a214-a142-43c7-b93d-ff2301a3e432 · Exploit
• https://osv.dev/vulnerability/CVE-2023-4820 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4820 · Security Note
• https://t.me/cibsecurity/72356 · Telegram Post
• https://t.me/cvenotify/113576 · Telegram Post
• https://twitter.com/CVEnew/status/1714006519342063821 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1714060121498681844 · Twitter Post