PublishPress Capabilities < 2.3.1 - Missing Authorization

The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator. id: CVE-2021-25032...

CVE-2026-74005

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...

CVE-2026-66630

Administrator SQL Injection in PublishPress Series = 3.1.3 versions...

CVE-2026-66617

Contributor Cross Site Scripting XSS in PublishPress Series = 3.1.3 versions...

EUVD-2026-81516

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...

CVE-2026-74005

CVE-2026-74005 is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in the WordPress PublishPress Series plugin (versions ≤ 3.1.3 ), discovered by researcher benzdeus . The flaw allows an attacker to forge requests on behalf of a user, with a CVSS 3.1 score of 5.4 (MEDIUM) — requ...

CVE-2026-74005 WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...

CVE-2026-66630 WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability

Administrator SQL Injection in PublishPress Series = 3.1.3 versions...

EUVD-2026-81510

Administrator SQL Injection in PublishPress Series = 3.1.3 versions...

CVE-2026-66630

SQL Injection vulnerability in the WordPress PublishPress Series plugin (versions ≤ 3.1.3 ), discovered by Ananda Dhakal via Patchstack . The flaw requires administrator-level privileges but changes scope, allowing an authenticated admin to inject SQL and achieve high confidentiality impact and l...

EUVD-2026-81503

Contributor Cross Site Scripting XSS in PublishPress Series = 3.1.3 versions...

CVE-2026-66617 WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in PublishPress Series = 3.1.3 versions...

CVE-2026-66617

A Contributor-level Cross Site Scripting (XSS) vulnerability affects the PublishPress Series WordPress plugin (aka "Organize Series") in versions

WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nixxies in WordPress Plugin PublishPress Series versions = 3.1.3...

WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin PublishPress Series versions = 3.1.3...

WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by benzdeus in WordPress Plugin PublishPress Series versions = 3.1.3...

CVE-2021-25032

CVE-2021-25032 PublishPress Capabilities 2.2 - 2.3 - Actualización no autenticada de opciones arbitrarias que compromete el blog Descripción El plugin no tiene comprobaciones de autorización ni CSRF al actualizar sus ajustes a través del hook init, y no garantiza que las opciones a actualizar...

CVE-2026-85657

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profilefieldsuseremailvalueprefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization...

CVE-2026-85657

The PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.15.0 . The flaw resides in the Co-Authors, Multiple Authors, and Guest Authors Author Box functionality, where the profile_fields_user_email_value_prefix paramete...

CVE-2026-85657 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profilefieldsuseremailvalueprefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization...