CVE-2026-114120

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpspeleditorform AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or...

CVE-2026-114120 SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpspeleditorform AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or...

CVE-2026-114120

Versions of SchedulePress before 5.3.5 are vulnerable to a missing authorization vulnerability via the wpsp_el_editor_form AJAX action. Authenticated users with Contributor-level privileges can exploit this by reusing the wpsp-el-editor nonce from the Elementor modal to modify post statuses and p...

CVE-2026-114120 SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpspeleditorform AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or...

CVE-2026-114120 SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpspeleditorform AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or...

EUVD-2026-107232

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpspeleditorform AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or...

WordPress SchedulePress authorization issue vulnerability

WordPress SchedulePress versions prior to 5.3.5 contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, allowing authenticated users at the Contributor level to modify the status and publication date of any article via wpspeleditorform AJ...

PT-2026-120571

Name of the Vulnerable Software and Affected Versions SchedulePress versions prior to 5.3.5 Description An authorization flaw exists that allows authenticated users with Contributor-level permissions to modify the status and publish date of any post. This is possible due to a missing capability...

EUVD-2024-47630

Malicious code in bioql PyPI...

EUVD-2024-30504

Malicious code in bioql PyPI...

CVE-2024-32717

Missing Authorization vulnerability in WPDeveloper SchedulePress.This issue affects SchedulePress: from n/a through 5.0.8...

CVE-2024-6557

The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.1.3. This is due the plugin utilizing the wpdeveloper library and...

CVE-2024-6557

The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.1.3. This is due the plugin utilizing the wpdeveloper library and...

CVE-2024-6557

The CVE-2024-6557 issue concerns the WordPress plugin SchedulePress (wp-scheduled-posts) with versions up to 5.1.3. The root cause is Full Path Disclosure caused by the plugin using the wpdeveloper library and leaving demo files in place while display_errors is enabled, enabling unauthenticated u...

CVE-2024-6557 SchedulePress <= 5.1.3 - Unauthenticated Full Path Disclosure

The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.1.3. This is due the plugin utilizing the wpdeveloper library and...

CVE-2024-6557 SchedulePress <= 5.1.3 - Unauthenticated Full Path Disclosure

The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.1.3. This is due the plugin utilizing the wpdeveloper library and...

WordPress SchedulePress plugin <= 5.1.3 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin SchedulePress versions = 5.1.3...

CVE-2024-6557: Exposure of Sensitive Information to an Unauthorized Actor

The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.1.3. This is due the plugin utilizing the wpdeveloper library and...

WordPress SchedulePress Plugin <= 5.1.3 is vulnerable to Sensitive Data Exposure

Software SchedulePress Type Plugin Vulnerable versions = 5.1.3 Fixed in 5.1.4 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-6557 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4befd0cb74c1 Credits stealthcopter Required...

PT-2024-37714 · WordPress · Schedulepress

Name of the Vulnerable Software and Affected Versions: SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress versions up to, and including, 5.1.3 Description: The issue is due to the plugin utilizing th...