The Blubrry PowerPress Podcasting plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the 'powerpress' and 'podcast' shortcodes do not adequately sanitize or escape user input, allowing authenticated users with contributor-level permissions or higher to inject malicious scripts. These scripts are stored and executed when other users access the affected pages, potentially compromising user sessions or data. The vulnerability affects all versions up to 11.15.15. The CVSS 3.1 score of 6.4 reflects a medium impact with network attack vector, low attack complexity, and privileges required at the contributor level.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages generated by the vulnerable shortcodes. This can lead to unauthorized script execution in the context of other users viewing those pages, potentially resulting in session hijacking or other client-side impacts. The vulnerability does not affect availability and requires authenticated access, limiting the attack scope. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the vulnerable shortcodes. Monitor for updates from Blubrry regarding patches or official mitigations.