Medium severity · published Sep 26, 2019
CVE-2015-9410
The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter
5.4
CVSS
1.2%
EPSS
No
On KEV
Description
The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Powerpress · Blubrry
6.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-9410
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-9410
Exploit
https://cybersecurityworks.com/zerodays/cve-2015-9410-blubrry.html
Exploit
https://github.com/cybersecurityworks/Disclosed/issues/7
Product
https://wordpress.org/plugins/powerpress/#developers
More from Powerpress
7.2
CVE-2021-24123
Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast Artwork section),…
6.5
CVE-2023-41239
WordPress PowerPress Podcasting Plugin <= 11.0.6 is vulnerable to Server Side Request Forgery (SSRF)
5.9
CVE-2024-9230
PowerPress Podcasting < 11.9.18 - Author+ XSS via Podcast URL
5.4
CVE-2023-4820
PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS
5.4
CVE-2023-30778
WordPress PowerPress Podcasting Plugin <= 10.0.1 is vulnerable to Cross Site Scripting (XSS)