CVE-2026-97319

Executive Summary

CVE-2026-97319 is a stored cross-site scripting (XSS) vulnerability in the PowerPress Podcasting plugin by Blubrry for WordPress, affecting all versions before 11.17.2. The flaw arises because the plugin fails to sanitize and escape a block attribute before rendering it in a page, allowing authenticated users with the contributor role or higher to inject persistent malicious scripts. Successful exploitation can lead to session hijacking, privilege escalation, and compromise of site visitors or administrative users.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting). According to the NVD description, the PowerPress Podcasting plugin "does not sanitize and escape a block attribute before outputting it in a page." This indicates a classic stored XSS condition within the WordPress block editor context: the plugin registers one or more custom blocks that accept attributes (configuration values supplied within the block markup), and one such attribute is written into the rendered HTML page without proper output encoding or input sanitization.

Stored XSS in WordPress plugins typically manifests when block attribute values are persisted to the database as part of post content and later echoed back into the page without escaping. Because the vulnerable input path is the block attribute itself, the injection point is the post editing interface — the block editor — rather than a front-end form. The contributor role in WordPress can create and edit their own posts, including inserting blocks, but cannot publish them without editorial review. Here, the access control boundary is insufficient because the plugin allows the malicious attribute value to be saved and later rendered, affecting any user — including administrators and unauthenticated visitors — who views the affected page.

The attack surface is the WordPress administrative interface and, subsequently, any public-facing page that renders the injected block. The trust boundary crossed is between a low-privileged authenticated user (contributor) and higher-privileged users or site visitors. No authentication bypass is required, but valid credentials with contributor-level access or above are a prerequisite. The vulnerability requires user interaction on the part of the victim (viewing the crafted page or previewing the post), which is reflected in the CVSS vector's UI:R component.

Notably, no CVSS score, CVSS vector, CWE identifier, or EPSS score was provided in the supplied intelligence data. The vector shown in the METADATA section above is an inference based on the vulnerability class (stored XSS requiring low privileges and user interaction) and should be treated as provisional until an authoritative score is assigned by NVD or the vendor.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-97319. The following attack chain is inferred strictly from the vulnerability class (stored XSS via unsanitized block attribute) and the NVD description. It does not rely on any fabricated function names, endpoints, or code paths.

1. Reconnaissance/target identification. The attacker identifies a WordPress site running the PowerPress Podcasting plugin in a version below 11.17.2. This can be accomplished by browsing the site's public pages for podcast-related content, enumerating plugin assets, or using search engines and Shodan-style dorks targeting WordPress sites that expose PowerPress plugin paths.

2. Prerequisite access. The attacker obtains or already possesses an account with at least the contributor role. This may be through self-registration if enabled, credential reuse, or social engineering. Contributors can create posts and insert blocks but cannot publish them directly.

3. Triggering the flaw. The attacker creates a new post, inserts a PowerPress block, and supplies a crafted value for the vulnerable block attribute. Because the plugin does not sanitize or escape the attribute before output, the malicious value is stored in the post content. When a victim views the post (or a preview is rendered), the unsanitized attribute is written into the HTML output, causing the injected script to execute in the victim's browser.

4. Payload/execution (class-level). The payload is a JavaScript execution primitive embedded within the attribute value. The specific payload depends on the context in which the attribute is output (e.g., an HTML attribute value or a script block), but the exploitation mechanism is arbitrary script execution in the origin of the affected WordPress site.

5. Post-exploitation impact. Once executed, the script can steal session cookies and authentication tokens, perform actions on behalf of the victim (including administrative actions if an admin views the page), redirect users to malicious sites, deface content, or establish persistent backdoors. Because the payload is stored, it affects every user who views the compromised page until it is removed.

Impact Assessment

The impact of CVE-2026-97319 is driven by the stored nature of the XSS and the privilege difference between the attacker (contributor) and potential victims (editors, administrators, and site visitors). A contributor-level account is relatively low-privilege, but the persistent payload can execute in the session of a higher-privileged user who reviews or views the post — providing a path to privilege escalation and full site compromise. For public-facing pages, the payload executes in the browsers of unauthenticated visitors, enabling session theft, credential phishing, drive-by redirects, and malware distribution.

Business impact includes reputational damage from defaced or malicious content, loss of customer trust, potential regulatory exposure if user data is exfiltrated, and operational costs associated with cleanup and incident response. The blast radius includes all users who interact with the affected page — both authenticated staff and external visitors. The provisional CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and changed scope (because the vulnerable component impacts resources beyond its security scope). The confidentiality and integrity impacts are low in the base metric, but real-world exploitation can escalate depending on the victim's privileges. Availability impact is none. The EPSS score has not yet been assigned by FIRST.org, so no probability estimate can be provided; CISA KEV status is NO, meaning there is no confirmed exploitation in the wild at this time.

Detection Guidance

Sigma Rule

title: Stored XSS via PowerPress Podcasting Plugin Block Attribute
id: 9f2c8a13-4b7e-4d2a-9c1f-3a5e6b7d8c90
status: experimental
description: Detects attempts to inject script content into PowerPress block attributes in WordPress post content.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97319
author: valtersit.com
date: 2026-01-01
logsource:
  product: wordpress
  service: audit
detection:
  selection_plugin:
    message|contains:
      - 'powerpress'
  selection_payload:
    message|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'onmouseover='
  condition: selection_plugin and selection_payload
falsepositives:
  - Legitimate editorial content containing code samples
level: high

YARA Rule

rule CVE_2026_97319_PowerPress_Stored_XSS
{
    meta:
        description = "Detects script injection patterns in PowerPress block attributes (CVE-2026-97319)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97319"
        severity = "high"

    strings:
        $pp_attr = "powerpress" nocase
        $script1 = "<script" nocase
        $script2 = "javascript:" nocase
        $handler1 = "onerror=" nocase
        $handler2 = "onload=" nocase
        $handler3 = "onmouseover=" nocase
        $handler4 = "onfocus=" nocase

    condition:
        $pp_attr and any of ($script*, $handler*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97319 PowerPress Podcasting Stored XSS Attempt"; flow:established,to_server; content:"powerpress"; nocase; http_uri; content:"<script"; nocase; http_client_body; sid:202697319; rev:1; reference:cve,2026-97319; classtype:web-application-attack; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ any where process.name == "php" and process.args : "*powerpress*" and process.args : "*<script*" ]
  [ any where network where destination.port in (80, 443) and url.path : "*powerpress*" ]

Splunk SPL Query

index=web OR index=wordpress sourcetype=access_combined OR sourcetype=wordpress_audit
(powerpress OR "wp-content/plugins/powerpress")
("<script" OR "javascript:" OR "onerror=" OR "onload=" OR "onmouseover=")
| stats count values(uri) as uris values(clientip) as src_ips by user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="wordpress,web,xss,">
  <rule id="100973" level="10">
    <decoded_as>json</decoded_as>
    <field name="plugin">powerpress</field>
    <match>powerpress</match>
    <regex><script|javascript:|onerror=|onload=|onmouseover=</regex>
    <description>CVE-2026-97319: Possible stored XSS injection in PowerPress Podcasting plugin block attribute</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_97319,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version metadata was provided in the intelligence data; the AFFECTED_VERSION value (< 11.17.2) is taken from the NVD description.

1. Immediate mitigations.

   • Restrict or disable user registration and audit contributor-level accounts. Remove or downgrade accounts that are not actively needed.
   • Enforce editorial review of all contributor-submitted content before publication so that malicious block attributes are reviewed by a trusted user rather than rendered to visitors or administrators.
   • Apply a strict Content Security Policy (CSP) that disallows inline script execution, which reduces the impact of XSS payloads even if they are stored.
   • Deploy a web application firewall (WAF) with virtual patching rules that block script tags and event-handler attributes in post content submissions.
   • Monitor and audit pages containing PowerPress blocks for unexpected script content.

2. Patch/upgrade steps.

   • Upgrade the PowerPress Podcasting plugin by Blubrry to version 11.17.2 or later as soon as a vendor release is confirmed. Because patch confidence is 0/4 and no patch source is currently tracked, verify the existence and integrity of the upgrade against the official Blubrry/WordPress plugin repository before deploying.
   • After upgrading, re-scan existing posts that contain PowerPress blocks for residual stored payloads and remove any that were injected prior to the update.
   • Rotate credentials and invalidate active sessions for any accounts suspected of compromise.

3. Long-term hardening.

   • Enforce the principle of least privilege for WordPress roles; avoid granting contributor or higher roles broadly.
   • Implement output encoding and input sanitization standards for all plugin development; validate that third-party plugin block attributes are escaped on output.
   • Enable centralized logging and alerting for content submissions and administrative actions.
   • Conduct periodic vulnerability scanning of WordPress plugins and maintain an inventory of installed components and versions.
   • Subscribe to vendor security advisories and monitor NVD for an assigned CVSS score and any updated patch information for CVE-2026-97319.

References

• NVD — CVE-2026-97319: https://nvd.nist.gov/vuln/detail/CVE-2026-97319
• Blubrry PowerPress Podcasting plugin (WordPress.org plugin repository): https://wordpress.org/plugins/powerpress/
• Blubrry official website and security advisories: https://blubrry.com/
• OWASP — Cross Site Scripting (XSS): https://owasp.org/www-community/attacks/xss/
• CWE-79 — Improper Neutralization of Input During Web Page Generation: https://cwe.mitre.org/data/definitions/79.html

No public proof-of-concept, exploit code, or Nuclei template is currently available for CVE-2026-97319. No exploit-in-the-wild activity, threat actor campaign, or CISA KEV entry has been reported. EPSS has not yet scored this vulnerability.