The PowerPress Podcasting plugin by Blubrry prior to version 11.16.11 contains a stored XSS vulnerability (CWE-79) due to insufficient sanitization and escaping of some Podcast Episode settings. This flaw permits users with Contributor roles, who normally have limited permissions, to inject persistent malicious scripts. The vulnerability bypasses the usual restriction imposed by the lack of unfiltered_html capability, increasing the risk of exploitation within WordPress environments using this plugin.

An attacker with Contributor-level access can exploit this vulnerability to execute arbitrary JavaScript in the context of other users' browsers. This could lead to session hijacking, privilege escalation, or other malicious actions depending on the victim's privileges and the injected payload. The vulnerability affects the integrity and confidentiality of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level user permissions and monitor for suspicious activity related to Podcast Episode settings. Avoid granting Contributor roles to untrusted users. Follow updates from Blubrry for a security patch or official mitigation instructions.