Plugins vulnerabilities
Plugin: Blubrry PowerPress
PowerPress Podcasting plugin by Blubrry < 11.12.7 (closed)
This plugin is closed. Please replace it with another.
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Global score: 4.9 / 10
Severity: Medium
[+] CVE-2025-32691 [+] PowerPress Podcasting <= 11.12.6 – Authenticated (Contributor+) Server-Side Request Forgery [+] EUVD-2025-10560
PowerPress Podcasting plugin by Blubrry < 11.12.16 (closed)
This plugin is closed. Please replace it with another.
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Global score: 6.5 / 10
Severity: Medium
[+] CVE-2025-32690 [+] WordPress PowerPress Podcasting Plugin <= 11.12.4 is vulnerable to Cross Site Scripting (XSS) [+] PowerPress Podcasting <= 11.12.5 – Authenticated (Contributor+) Stored Cross-Site Scripting [+] EUVD-2025-10563
PowerPress Podcasting plugin by Blubrry < 11.12.6 (closed)
This plugin is closed. Please replace it with another.
Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Global score: 9.9 / 10
Severity: Critical
[+] CVE-2025-46264 [+] PowerPress Podcasting plugin by Blubrry <= 11.12.5 – Authenticated (Contributor+) Stored Cross-Site Scripting [+] EUVD-2025-12067
Plugin: Contact Form 7
Contact Form 7 Error: Contact form not found. < 6.0.6 (closed)
This plugin is closed. Please replace it with another.
[+] CVE-2025-3247 [+] WordPress Contact Form 7 Plugin <= 6.0.5 is vulnerable to Other Vulnerability Type [+] Contact Form 7 <= 6.0.5 – Order Replay Vulnerability [+] EUVD-2025-11473
Plugin: Smash Balloon Instagram Feed
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 6.9.1
[+] CVE-2025-4583 [+] WordPress Instagram Feed Plugin <= 6.9.0 is vulnerable to Cross Site Scripting (XSS) [+] Smash Balloon Instagram Feed <= 6.9.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute
|