CVE-2026-97354 — PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing use…
Published: 2026-10-07 · CVSS: 4.1 · CVSS 3.1
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7