CVE-2026-5247

🗓️ 05 May 2026 02:26:56Reported by WordfenceType

Administrators can trigger stored XSS via the futureaction wrapper attribute until version 4.10.0.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-5247	5 May 202602:26	–	attackerkb
Circl	CVE-2026-5247	8 May 202617:33	–	circl
CNNVD	WordPress plugin Schedule Post Changes With PublishPress Future 跨站脚本漏洞	5 May 202600:00	–	cnnvd
Cvelist	CVE-2026-5247 Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute	5 May 202602:26	–	cvelist
EUVD	EUVD-2026-27191	5 May 202603:31	–	euvd
NVD	CVE-2026-5247	5 May 202603:15	–	nvd
Patchstack	WordPress Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability	4 May 202614:02	–	patchstack
Positive Technologies	PT-2026-36954	5 May 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-5247 Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute	5 May 202602:26	–	vulnrichment

Vulners

Node

publishpress schedule_post_changes_with_publishpress_future:_unpublish,_delete,_change_status,_trash,_change_categoriesRange≤4.10.0wordpress

[
  {
    "vendor": "publishpress",
    "product": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.10.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/publishpress/publishpress-future/releases
plugins	www.plugins.trac.wordpress.org/browser/post-expirator/trunk/src/Modules/Expirator/Controllers/ShortcodeController.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/9acf80aa-8354-4430-9836-18fa17854521
plugins	www.plugins.trac.wordpress.org/browser/post-expirator/tags/4.9.4/src/Modules/Expirator/Controllers/ShortcodeController.php

05 May 2026 19:09Current

6Medium risk

Vulners AI Score6

CVSS 3.15.5

EPSS0.00036

SSVC

CWE-79