CVE-2026-2988

CYBERSECURITY BRIEFING NOTE CVE-2026-2988 is a Stored Cross-Site Scripting vulnerability affecting the Blubrry PowerPress plugin for WordPress in versions 11.15.15 and earlier. The flaw exists in the 'powerpress' and 'podcast' shortcodes due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level or higher privileges to inject and execute arbitrary web scripts that persist in affected pages. The vulnerability carries a CVSS severity rating of 6.4 (Medium) with a network-based attack vector requiring low complexity and low privileges. The attack requires user interaction to trigger the payload when accessing injected pages. The impact scope is changed, affecting both confidentiality and integrity with limited severity. The FAUCET Risk Score of 44.0 out of 100 indicates moderate risk requiring management attention. There is no current evidence of active exploitation. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities list and is rated as inactive on the Hot List. The extremely low EPSS score of 0.00011 suggests minimal probability of exploitation in the wild, indicating this threat remains theoretical rather than practically weaponized at present. Organizations should prioritize patching based on their WordPress plugin inventory and contributor access controls.