EUVD-2026-114646
GHSA-6x99-gc47-w4j4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain subscriber-level account with a mapped author term
-
DeliverySubmit XSS payload via author 'name'/display_name field
-
ExploitPayload stored without sufficient sanitization
-
ExecutionVictim loads page rendering author box
-
ImpactScript executes in victim browser context (scope change)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with at least subscriber-level access (PR:L) AND, critically, that account must have a mapped author term - which exists only when an administrator has assigned the user as a co-author on content, or has enabled automatic author-term creation for the user's role. The description explicitly states this mapping is NOT present by default for new users on a stock install, so default installations are not exploitable by an arbitrary self-registered subscriber. Exploitation also depends on a victim subsequently viewing a page that renders the affected author box. These factors (authentication, the non-default author-term prerequisite, and victim page access) materially limit realistic exploitation despite the network attack vector. |
| Impact | This is a medium-severity stored XSS (CVSS 6.4) whose real-world priority is moderate rather than urgent. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates a network-reachable, low-complexity flaw requiring only low privileges, with a scope change reflecting script execution in other users' browser context. However, the signals do not point to an emergency: there is no CISA KEV listing (not actively exploited), no EPSS score was supplied, and no confirmed public exploit code - the references are a Wordfence advisory and plugin source-code lines, not weaponized PoC. The vuln.today decision label is 'this_month', consistent with 'remediate on a normal cycle' rather than act_now. The most important risk-limiting factor is a precondition the raw CVSS does not capture: the attacking account must already have a mapped author term (assigned as a co-author, or automatic author-term creation enabled for its role), which the description states is NOT present by default for new users on a stock install. This meaningfully narrows the exploitable population below what PR:L alone implies. Net: a genuine but not top-tier issue - patch on a normal monthly cadence, with somewhat higher urgency for sites that routinely assign subscribers/contributors as co-authors. |
| Exploit ScenarioDerived | An authenticated attacker holding at least subscriber-level access on a site where their account has been given a mapped author term injects a malicious script into the 'name' (display_name) field of their author profile. The payload is stored and then executes in the browser of any user - including administrators - who views a page rendering that author box. No confirmed public exploit code was identified at the time of analysis; the flaw is low-complexity (AC:L) and network-reachable (AV:N) but gated by the author-term precondition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 31, 2026
Stored cross-site scripting in the PublishPress Authors WordPress plugin (Co-Authors, Multiple Authors and Guest Authors in an Author Box) affects all versions up to and including 4.17.0, where the author 'name' field, which maps to the WordPress display_name, is insufficiently sanitized on input and escaped on output. An attacker holding an authenticated account at subscriber level or above can persist arbitrary script into an author box that executes for anyone viewing an injected page; the CVSS 3.1 vector scores 6.4 with scope change (S:C) because the payload runs in the context of the viewing user rather than the injecting one. Exploitation is gated by a non-default prerequisite: the attacker's account must already have a mapped author term, which only exists if an administrator assigned them as a co-author or enabled automatic author-term creation for their role, so a stock install with self-registered subscribers is not exploitable. No public exploit code or active exploitation is identified at time of analysis, and the plugin's 4.18.0 tag contains the revised Author_Editor.php referenced as the fix.
RemediationAI
Upgrade the PublishPress Authors plugin to 4.18.0 or later, the release tag in which the corrected Author_Editor.php appears (https://plugins.trac.wordpress.org/browser/publishpress-authors/tags/4.18.0/src/core/Classes/Author_Editor.php), and confirm the upgrade completes on every site in a multisite network where the plugin is active on individual subsites. Because the only confirmed exploitation path runs through an author term mapped to the attacker's account, the effective compensating controls are configuration ones: do not enable automatic author-term creation for subscriber or other low-privilege roles, and audit existing co-author assignments so that only trusted accounts hold mapped author terms, accepting that this restricts the plugin's collaborative-author workflow for untrusted contributors. Where automatic term creation cannot be disabled for business reasons, treat subscriber self-registration as equivalent to granting stored content-injection capability and gate registration accordingly; the trade-off is reduced self-service onboarding. Reviewing and re-saving existing author display names removes already-persisted payloads, but be aware that clean-up only helps until the upgrade is applied, since the write path remains open on 4.17.0 and earlier.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-79 cross-site scripting issue in a WordPress plugin that repurposes WordPress user accounts as public-facing author profiles: PublishPress Authors stores an author 'name' value in its own author editor (src/core/Classes/Author_Editor.php) and writes it back to the WordPress display_name, then renders it through the multiple-authors module (src/modules/multiple-authors/multiple-authors.php) into author boxes and archive pages. Because the name is persisted server-side and echoed later to other visitors, this is the stored rather than reflected variant of XSS, and the CPE string confirms the affected package as publishpress:co-authors,_multiple_authors_and_guest_authors_in_an_author_box_with_publishpress_authors with no version constraint pinned in the CPE itself, matching the advisory's 'all versions up to and including 4.17.0' range. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N describes an authenticated (PR:L) network-reachable injection with low confidentiality and integrity impact but no availability impact, and the scope change reflects that the injected script executes against victims who are not the attacker's own security context. The trigger path requires the attacker's account to be linked to an author term; the advisory states this mapping is absent for new users by default, making it an administrative configuration rather than a flaw any self-registered user can reach unaided.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Authenticated subscriber-level attacker (PR:L), network-reachable low-complexity injection, stored script executes in other users' browser context so scope changes (S:C) with low confidentiality/integrity impact and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (maps to display_name)' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker's user account to have a mapped author term, which occurs when an administrator has assigned them as a co-author on content or has enabled automatic author term creation for their role - this mapping is not present by default for new users on a stock install.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB