💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program.

Through January 6th, 2025, our program has an expanded scope for all researchers with a new lower active install count threshold, automatic bonuses for in-scope submissions, an extra bonus for those focusing on high-risk vulnerabilities, a minimum bounty for all submissions, increased pending report limits, and our rewards remain as high as $31,200.

Review what's in scope for your tier and updated bounties with bonuses here!

PowerPress Podcasting plugin by Blubrry

Wordfence Intelligence > Vulnerability Database > WordPress Plugins > PowerPress Podcasting plugin by Blubrry

Information

Software Type	Plugin
Software Slug	powerpress (view on wordpress.org)
Software Status	Active
Software Author	amandato
Software Website	blubrry.com
Software Downloads	5,351,047
Software Active Installs	30,000
Software Record Last Updated	December 22, 2024

11 Vulnerabilities

Submit a Vulnerability

Powerpress <= 11.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode

6.4

CVE-2024-9543

Oct 10, 2024

Researcher: Jack Taylor

PowerPress Podcasting plugin by Blubrry <= 11.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter

6.4

CVE-2024-6588

Jul 11, 2024

Researcher: Webbernaut

Several WordPress.org Plugins <= Various Versions - Injected Backdoor

10.0

CVE-2024-6297

Jun 24, 2024

Researchers:

PowerPress <= 11.0.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Media URL

6.4

CVE-2023-4820

Sep 13, 2023

Researcher: emad

PowerPress <= 11.0.6 - Authenticated (Contributor+) Server-Side Request Forgery via wp_ajax_powerpress_media_info

5.4

CVE-2023-41239

Aug 29, 2023

Researcher: Mika

PowerPress <= 10.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Feed[title]'

4.4

CVE ID Unknown

Jun 6, 2023

Researchers:

PowerPress <= 10.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

5.4

CVE-2023-30778

Apr 17, 2023

Researcher: Mika

PowerPress <= 10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

5.4

CVE-2023-1917

Apr 11, 2023

Researcher: Alex Thomas

PowerPress <= 8.3.7 - Arbitrary File Upload

7.2

CVE-2021-24123

Oct 11, 2020

Researcher: Minh Tuan - SunCSR (Sun* Cyber Security Research)

PowerPress <= 6.0.4 - Reflected Cross-Site Scripting

6.1

CVE-2015-9410

Sep 14, 2015

Researcher: Cyber Security Works Pvt. Ltd

PowerPress <= 6.0.0 - Cross-Site Scripting

6.1

CVE-2015-1385

Jan 29, 2015

Researcher: Omar Kurt

Title	Status	CVE ID	CVSS	Researchers	Date
Powerpress <= 11.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode	Patched	CVE-2024-9543	6.4	Jack Taylor	October 10, 2024
PowerPress Podcasting plugin by Blubrry <= 11.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter	Patched	CVE-2024-6588	6.4	Webbernaut	July 11, 2024
Several WordPress.org Plugins <= Various Versions - Injected Backdoor	Patched	CVE-2024-6297	10.0		June 24, 2024
PowerPress <= 11.0.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Media URL	Patched	CVE-2023-4820	6.4	emad	September 13, 2023
PowerPress <= 11.0.6 - Authenticated (Contributor+) Server-Side Request Forgery via wp_ajax_powerpress_media_info	Patched	CVE-2023-41239	5.4	Mika	August 29, 2023
PowerPress <= 10.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Feed[title]'	Patched		4.4		June 6, 2023
PowerPress <= 10.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Patched	CVE-2023-30778	5.4	Mika	April 17, 2023
PowerPress <= 10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Patched	CVE-2023-1917	5.4	Alex Thomas	April 11, 2023
PowerPress <= 8.3.7 - Arbitrary File Upload	Patched	CVE-2021-24123	7.2	Minh Tuan - SunCSR (Sun* Cyber Security Research)	October 11, 2020
PowerPress <= 6.0.4 - Reflected Cross-Site Scripting	Patched	CVE-2015-9410	6.1	Cyber Security Works Pvt. Ltd	September 14, 2015
PowerPress <= 6.0.0 - Cross-Site Scripting	Patched	CVE-2015-1385	6.1	Omar Kurt	January 29, 2015

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation