CVE-2026-12098

MediumCVSS 6.4/10Last modified Jun 18, 2026

Description

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed' Episode Meta Field in all versions up to, and including, 11.16.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The embed value is stored via update_post_meta() rather than through WordPress core's post content pipeline, meaning kses-on-save filtering is never applied — even for Author-role users who would otherwise lack unfiltered_html — making this path unprotected by WordPress's standard role-based XSS mitigations.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
blubrry	PowerPress Podcasting plugin by Blubrry	<= 11.16.8

References

Timeline

Published: Jun 18, 2026
Last modified: Jun 18, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1209805.3On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE routers can send a CVE-2026-1209815.3On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE router can affect CVE-2026-1209827.5On affected platforms running Arista EOS with Border Gateway Protocol (BGP) configured, An unauthenticated attacker who can establish a BGP CVE-2026-1209837.6On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing CVE-2026-1209849.1A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enab CVE-2026-1209877.5Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.CVE-2026-1209886.1billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend templa CVE-2026-1209972.3Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web all CVE-2026-1209997.4Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers CVE-2026-12106.4The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_elementor_data' meta field in all CVE-2026-121007.2The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' pa CVE-2026-1210067.5HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add()