CVE-2024-6588 is a reflected cross-site scripting vulnerability in the PowerPress Podcasting plugin by Blubrry for WordPress. The issue exists in the handling of the 'media_url' parameter, which lacks proper input sanitization and output escaping, enabling injection of malicious scripts. This vulnerability affects all versions up to and including 11.9.10. Exploitation requires tricking a user into clicking a crafted link, leading to script execution in the user's browser context. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact with no availability impact.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to partial confidentiality and integrity compromise. This could result in unauthorized actions performed on behalf of users or theft of sensitive information accessible via the browser session. The vulnerability does not impact availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected parameter if possible and exercise caution with untrusted links. Monitor official Blubrry communications for updates regarding patches or mitigations.