PowerPress Podcasting <= 6.0.0 is vulnerable to XSS

Unauthenticated

Published
2015-01-26

Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmin_categoryfeeds.php page to wp-admin/admin.php.

CVE

https://www.cve.org/CVERecord?id=CVE-2015-1385

CVSS

Score:6.1

Severity:Medium

Version: 6.0.0

There is a patch available in v6.0.1 and we strongly recommend you update to this version as soon as possible.