CVE-2026-2988 is a stored cross-site scripting vulnerability in the Blubrry PowerPress Podcasting plugin for WordPress, affecting versions up to and including 11.15.15. The issue stems from improper neutralization of input during web page generation, specifically in the 'powerpress' and 'podcast' shortcodes. Authenticated users with contributor-level privileges or higher can inject arbitrary web scripts that execute in the context of other users viewing the compromised pages. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, no user interaction, and scope change.

Successful exploitation allows an authenticated contributor or higher to inject and execute arbitrary scripts in the context of other users accessing the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation. There is no impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider monitoring for suspicious activity related to shortcode usage. Avoid exposing pages with these shortcodes to untrusted users where possible.