The PowerPress Podcasting plugin by Blubrry prior to version 11.16.11 fails to properly sanitize and escape some Podcast Episode settings. This flaw enables users with Contributor privileges to perform stored Cross-Site Scripting (CWE-79) attacks, bypassing restrictions on unfiltered HTML content. The vulnerability has a CVSS 3.1 base score of 6.8, indicating a medium severity with network attack vector, low attack complexity, high privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with Contributor-level access to inject and store malicious scripts that execute in the context of other users viewing the affected podcast episode settings. This could lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of the affected WordPress site.

No official patch or remediation guidance is currently confirmed. Users should monitor the vendor's advisory for updates and apply the official fix once available. Until then, restrict Contributor role assignments and consider additional input sanitization controls or security plugins to mitigate stored XSS risks.