Skip to content

Publishpress vulnerabilities

Products

Newest

publishpress revisions WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability CVE-2026-120851 4.3 MediumNovember 6, 2026
publishpress co-authors, multiple authors and guest authors in an author box with publishpress authors Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author… CVE-2026-111592 6.4 MediumOctober 31, 2026
publishpress authors WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-115610 6.5 MediumOctober 29, 2026
publishpress schedule post changes with publishpress future: unpublish, delete, change status, trash, change categories PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes CVE-2026-105261 6.8 MediumOctober 14, 2026
publishpress capabilities WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability CVE-2026-48197 7.2 HighOctober 6, 2026
publishpress series WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-39444 5.4 MediumOctober 2, 2026
publishpress capabilities WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-94487 8.1 HighSeptember 23, 2026
publishpress series WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-74005 5.4 MediumSeptember 17, 2026
publishpress series WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability CVE-2026-66630 7.6 HighSeptember 17, 2026
publishpress series WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability CVE-2026-66617 6.5 MediumSeptember 17, 2026
publishpress co-authors, multiple authors and guest authors in an author box with publishpress authors Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix'… CVE-2026-85657 5.4 MediumSeptember 15, 2026
publishpress user role editor – publishpress capabilities: access control and user roles PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant CVE-2026-75927 7.2 HighSeptember 9, 2026
publishpress permissions WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-84771 5.3 MediumSeptember 2, 2026
publishpress series WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-27365 5.9 MediumAugust 18, 2026
publishpress capabilities WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability CVE-2026-28183 7.2 HighAugust 6, 2026
publishpress schedule post changes with publishpress future: unpublish, delete, change status, trash, change categories Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcod… CVE-2026-5247 5.5 MediumMay 5, 2026
publishpress post expirator WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-39482 6.5 MediumApril 8, 2026
publishpress revisions WordPress PublishPress Revisions plugin <= 3.7.23 - SQL Injection vulnerability CVE-2026-32539 9.3 CriticalMarch 25, 2026
publishpress authors WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability CVE-2026-25309 7.5 HighMarch 25, 2026
publishpress capabilities WordPress PublishPress Capabilities plugin <= 2.31.0 - Broken Access Control vulnerability CVE-2026-32394 4.3 MediumMarch 13, 2026
publishpress authors WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability CVE-2026-25330 4.3 MediumFebruary 19, 2026
publishpress revisions WordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-25322 5.4 MediumFebruary 19, 2026
publishpress schedule post changes with publishpress future: unpublish, delete, change status, trash, change categories Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation CVE-2025-14718 5.4 MediumJanuary 9, 2026
publishpress post expirator WordPress Post Expirator plugin <= 4.9.3 - Broken Access Control vulnerability CVE-2025-69361 4.3 MediumJanuary 6, 2026
publishpress schedule post changes with publishpress future: unpublish, delete, change status, trash, change categories Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) Authors' Emails Exposure CVE-2025-13741 4.3 MediumDecember 16, 2025
publishpress schedule post changes with publishpress future: unpublish, delete, change status, trash, change categories Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification CVE-2025-13149 4.3 MediumNovember 21, 2025
publishpress blocks – block controls, block visibility, block permissions Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-8588 6.4 MediumOctober 25, 2025
publishpress gutenberg blocks WordPress Gutenberg Blocks <= 3.3.1 - Local File Inclusion Vulnerability CVE-2025-48332 7.5 HighAugust 14, 2025
publishpress gutenberg blocks WordPress Gutenberg Blocks plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability CVE-2025-49032 6.5 MediumJuly 3, 2025
publishpress authors WordPress PublishPress Authors plugin <= 4.7.5 - Local File Inclusion Vulnerability CVE-2025-47496 7.5 HighMay 7, 2025
publishpress authors WordPress PublishPress Authors plugin <= 4.7.3 - SQL Injection vulnerability CVE-2025-26886 7.6 HighMarch 15, 2025
kevinb publishpress revisions: duplicate posts, submit, approve and schedule content changes, publishpress revisions: duplicate posts, submit, approve and schedule content changes, kevinb publishpress revisions duplicate posts submit approve and schedule content changes +2 more PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure CVE-2024-11154 4.3 MediumNovember 20, 2024
publishpress authors, co-authors, multiple authors and guest authors in an author box with publishpress authors +1 more Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account… CVE-2024-9215 8.8 HighOctober 17, 2024
kevinb publishpress revisions: duplicate posts, submit, approve and schedule content changes, publishpress revisions: duplicate posts, submit, approve and schedule content changes +1 more PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.14 - Reflected Cross-Site Scripting CVE-2024-9436 6.1 MediumOctober 11, 2024
publishpress capabilities, unknown publishpress capabilities pro, publishpress capabilities – user role access, editor permissions, admin menus +2 more PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection CVE-2022-3366 7.2 HighOctober 31, 2022
publishpress capabilities, unknown publishpress capabilities pro, publishpress capabilities – user role access, editor permissions, admin menus +2 more PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise CVE-2021-25032 Public exploit 9.8 CriticalJanuary 10, 2022
publishpress post expirator, unknown post expirator: automatically unpublish wordpress posts +1 more Post Expirator < 2.6.0 - Contributor+ Arbitrary Post Schedule Deletion CVE-2021-24783 6.5 MediumNovember 8, 2021