PublishPress Capabilities < 2.3.1 - Missing Authorization

The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator. id: CVE-2021-25032...

WordPress Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by muhammad nizar in WordPress Plugin PublishPress Authors versions = 4.17.0...

CVE-2026-111592

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name maps to displayname' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and outp...

EUVD-2026-114646

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name maps to displayname' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and outp...

CVE-2026-111592 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name maps to displayname' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and outp...

CVE-2026-111592

The PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.17.0 . The flaw exists in the Co-Authors, Multiple Authors, and Guest Authors components due to insufficient input sanitization and output escaping of the 'name (...

CVE-2026-111592: publishpress: The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is…

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name maps to displayname' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and outp...

PT-2026-134474

Name of the Vulnerable Software and Affected Versions PublishPress Authors versions prior to 4.17.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the name...

CVE-2021-25032

CVE-2021-25032 PublishPress Capabilities 2.2 - 2.3 - Unauthenticated Arbitrary Options Update to Blog Compromise Description The plugin does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to t...

CVE-2026-115610

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0...

CVE-2026-115610 WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0...

CVE-2026-115610

The PublishPress PublishPress Authors WordPress plugin (versions up to and including 4.17.0 ) is susceptible to a Stored Cross-site Scripting (XSS) vulnerability. The root cause is the Improper Neutralization of Input During Web Page Generation . This flaw allows an attacker to store malicious sc...

EUVD-2026-112865

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0...

WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin PublishPress Authors versions = 4.17.0...

CVE-2026-105261

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting elemen...

CVE-2026-105261 PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting elemen...

EUVD-2026-100878

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting elemen...

CVE-2026-105261

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin versions 4.10.1 through 4.10.5 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to enforce a safe HTML-element allowlist on short...

CVE-2026-105261 PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting elemen...

PT-2026-113657

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting elemen...