CVE-2026-16293: PowerPress Podcasting Plugin XSS Flaw

CVE-2026-16293 Overview

CVE-2026-16293 is a stored Cross-Site Scripting (XSS) vulnerability in the PowerPress Podcasting plugin by Blubrry for WordPress. The plugin fails to sanitize and escape several Podcast Episode settings before rendering them. Authenticated users with a role as low as Contributor can inject persistent JavaScript payloads, even when the unfiltered_html capability is disallowed. All versions prior to 11.16.11 are affected. The flaw is tracked as CWE-79 and can lead to session hijacking, privilege escalation, and administrative account takeover when a higher-privileged user views the malicious episode content.

Critical Impact
A Contributor-level account can store JavaScript that executes in the browser of any editor or administrator who opens the affected podcast episode, enabling account takeover.

Affected Products

PowerPress Podcasting plugin by Blubrry for WordPress, all versions before 11.16.11
WordPress sites permitting Contributor-level (or higher) registration with the plugin installed
Any downstream WordPress deployment bundling the vulnerable PowerPress release

Discovery Timeline

2026-08-04 - CVE-2026-16293 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-16293

Vulnerability Analysis

The vulnerability resides in the handling of Podcast Episode settings exposed by the PowerPress plugin. Input supplied to specific episode fields is stored in the WordPress database and later rendered to the page without proper output encoding. Because WordPress normally strips dangerous HTML from Contributor-authored content via the unfiltered_html capability, developers frequently rely on that gate for XSS protection. PowerPress bypasses this control by writing the raw episode metadata directly into the response, so the capability check offers no defense here. A Contributor can therefore persist arbitrary <script> payloads that execute whenever an Editor or Administrator previews the post, moderates the queue, or the episode is served on the public site.

Root Cause

The root cause is missing input sanitization and missing output escaping on Podcast Episode settings handled by the plugin. User-controlled values are neither filtered through sanitize_text_field() nor escaped via esc_attr() or esc_html() at render time, violating standard WordPress secure coding guidance for plugin metadata.

Attack Vector

Exploitation requires an authenticated session with at least Contributor privileges and a follow-up interaction by a higher-privileged user. The attacker submits a draft podcast episode, injects a JavaScript payload into a vulnerable episode setting field, and saves the draft. When an Editor or Administrator opens the submission for review, the payload executes in their browser under the site origin. Common post-exploitation actions include stealing authentication cookies, creating new administrator accounts through the REST API, injecting persistent backdoors into theme files, and pivoting to server-side code execution via the plugin editor.

No verified exploit code has been published. The WPScan Vulnerability Report describes the affected settings and remediation.

Detection Methods for CVE-2026-16293

Indicators of Compromise

Podcast episode records in wp_postmeta containing <script>, onerror=, onload=, or javascript: substrings within PowerPress-prefixed meta keys.
Unexpected creation of new administrator users or application passwords shortly after an Editor or Administrator previews a Contributor-submitted podcast episode.
Outbound requests from wp-admin sessions to unfamiliar domains referenced in stored episode metadata.
Modifications to theme or plugin PHP files timestamped after episode review activity by privileged accounts.

Detection Strategies

Query the WordPress database for PowerPress episode meta fields containing HTML event handlers or script tags, and alert on any matches.
Monitor wp-admin activity for privileged users triggering script execution while viewing posts of type podcast episode.
Correlate creation of new administrative accounts with recent Contributor submissions to catch post-XSS privilege escalation.

Monitoring Recommendations

Enable a Content Security Policy (CSP) with script-src restrictions and log CSP violation reports from wp-admin pages.
Forward WordPress audit logs and web server access logs to a centralized analytics platform for correlation across user roles and actions.
Track plugin version inventory across all WordPress instances and flag deployments running PowerPress below 11.16.11.

How to Mitigate CVE-2026-16293

Immediate Actions Required

Update the PowerPress Podcasting plugin to version 11.16.11 or later on every affected WordPress site.
Audit existing podcast episodes, drafts, and pending submissions for embedded script content and remove any suspicious entries.
Review the wp_users and wp_usermeta tables for unauthorized administrator accounts or recently issued application passwords.
Force a password reset for all Editor and Administrator accounts if evidence of exploitation is found.

Patch Information

Blubrry addressed the issue in PowerPress Podcasting 11.16.11 by adding sanitization and escaping to the affected Podcast Episode settings. Administrators should install the update through the WordPress plugin manager or via WP-CLI. Refer to the WPScan Vulnerability Report for confirmation of the fixed version.

Workarounds

Restrict Contributor-level registrations and require manual approval of new low-privileged accounts until patching is complete.
Temporarily deactivate the PowerPress plugin on sites that cannot be updated immediately.
Deploy a Web Application Firewall (WAF) rule to block HTML tags and event handlers submitted to PowerPress episode endpoints.
Enforce a strict Content Security Policy on wp-admin to block inline script execution.

bash

# Update PowerPress via WP-CLI on all sites
wp plugin update powerpress --version=11.16.11

# Verify installed version
wp plugin get powerpress --field=version

# Search post meta for suspicious payloads in podcast episodes
wp db query "SELECT post_id, meta_key FROM wp_postmeta \
  WHERE meta_key LIKE 'powerpress_%' \
  AND (meta_value LIKE '%<script%' \
       OR meta_value LIKE '%onerror=%' \
       OR meta_value LIKE '%javascript:%');"