Blubrry provides podcast hosting and distribution services through WordPress plugins, principally PowerPress and Subscribe Sidebar, which extend content management systems with media delivery and audience engagement capabilities. Its vulnerability footprint centers on application-layer input handling and file-management flaws characteristic of web-facing plugins, specifically cross-site scripting, server-side request forgery, and unrestricted file uploads that arise from the integration demands of WordPress ecosystems. Current severity and exploitation status are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Blubrry over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-24123HIGH Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast Artwork section), al | Mar 18, 2021 | 7.2 | 23 | NO | NO |
CVE-2020-25033MEDIUM The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS. | Aug 31, 2020 | 6.1 | 21 | NO | NO |
CVE-2023-41239MEDIUM Server-Side Request Forgery (SSRF) vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry.This issue affects PowerPress Podcasting plugin by Blubrry: from n/a through 11. | Nov 13, 2023 | 6.5 | 19 | NO | NO |
CVE-2024-9230MEDIUM The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and ab | Apr 14, 2025 | 5.9 | 18 | NO | NO |
CVE-2023-4820MEDIUM The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as lo | Oct 16, 2023 | 5.4 | 18 | NO | NO |
CVE-2023-30778MEDIUM Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry plugin <= 10.0.1 versions. | Aug 15, 2023 | 5.4 | 18 | NO | NO |
CVE-2023-1917MEDIUM The PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 10.0 due to insufficient input sani | Jun 9, 2023 | 5.4 | 18 | NO | NO |
CVE-2015-9410MEDIUM The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter. | Sep 26, 2019 | 5.4 | 17 | NO | NO |
CVE-2024-9227MEDIUM The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users t | May 15, 2025 | 4.8 | 15 | NO | NO |
CVE-2015-1385MEDIUM Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via t | Feb 2, 2015 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Blubrry.
Media articles that mention a CVE ID that affects a product developed by Blubrry — matched by CVE ID, not by vendor name.