EUVD-2026-112865
GHSA-76qm-2fv3-gv97
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged WordPress user
-
DeliverySubmit crafted payload into unsanitized Authors field
-
ExploitPayload stored in database
-
ExecutionAdmin views affected page
-
ImpactScript executes in admin browser context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with at least low privileges (PR:L) capable of submitting content through PublishPress Authors, plus subsequent interaction by a victim user (UI:R) who views the stored payload - typically a higher-privileged administrator or editor in wp-admin. These two prerequisites (valid low-privilege account AND victim rendering the content) are the main limiting factors; the flaw is not exploitable by a fully unauthenticated attacker against a passive target. The specific input field or feature that fails neutralization is not described in the available sources. Affects PublishPress Authors from n/a through 4.17.0. |
| Impact | This is a moderate-severity stored XSS (CVSS 6.5, CWE-79) in the PublishPress Authors WordPress plugin, and the available signals point to a real-but-not-urgent issue rather than a top-priority emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) describes network-reachable, low-complexity exploitation that nonetheless requires an authenticated low-privileged account (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting script execution in another user's browser/security context; impacts are only Low across C/I/A. No EPSS score, no CISA KEV listing, and no verified working exploit code were supplied, and the single reference is a Patchstack advisory rather than a proof-of-concept - so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_month', consistent with a bug worth patching on a normal cycle rather than an act_now/emergency. Net: a legitimate stored-XSS flaw to remediate, but the authentication-plus-interaction prerequisites and limited impact keep real-world risk below what the raw CVSS alone might suggest. Missing EPSS/KEV data is an absence of signal, not a contradiction. |
| Exploit ScenarioDerived | A low-privileged authenticated user (such as a contributor or author) submits content through a PublishPress Authors field that is not properly neutralized, storing a malicious script. When a higher-privileged user such as an administrator later views that content in wp-admin, the script executes in their browser session (the S:C scope change), potentially leading to session/action abuse. No verified public exploit code was provided; the only reference is the Patchstack advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Stored cross-site scripting (CVSS 6.5, CWE-79) in the PublishPress Authors WordPress plugin affects all versions through 4.17.0 and lets an authenticated low-privilege user plant script content that executes in the browser of any higher-privileged user - typically an editor or administrator - who later views the affected author screen. Exploitation needs a valid low-privilege account (PR:L) plus victim interaction with the rendered payload (UI:R), so it is a post-authentication, second-party-triggered issue rather than an unauthenticated attack; scope is marked changed (S:C), with low confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the available signals place this as a moderate, non-emergency item to schedule within the normal monthly patch cadence.
RemediationAI
No vendor-released patch version is identified in the supplied data; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/publishpress-authors/vulnerability/wordpress-publishpress-authors-plugin-4-17-0-cross-site-scripting-xss-vulnerability) is the authoritative place to confirm a fixed release before upgrading, and sites running 4.17.0 or earlier should track it for a patched version rather than assume 4.17.0 is current-safe. Because the flaw requires an authenticated low-privilege account (PR:L) to persist the payload and a victim to render it (UI:R), a practical compensating control until a fix is published is to tighten who can create or edit author profiles and author taxonomy terms, restricting that capability to trusted roles - the trade-off is reduced editorial flexibility and extra administrative overhead for multi-author sites. Sites can also review existing author display names, bios and profile fields for injected markup and remove anything unexpected, and can apply a filtering rule that strips script markup from those fields, though such filtering is bypassable and should be treated as temporary containment only, not as a substitute for a vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. stored/persistent XSS) in PublishPress Authors, a WordPress plugin that adds multi-author profile management, author taxonomy terms and author boxes to a site. Data submitted through the plugin is persisted and later rendered in wp-admin and front-end contexts without correct output encoding, so the payload survives across requests instead of reflecting once. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L confirms the preconditions: network reachable, low complexity, an authenticated low-privilege account is required, a victim must render the stored content, and the injected script runs in the changed scope of the viewing user, which is what makes an editor or administrator session the meaningful target. The supplied sources do not describe which specific plugin field or feature fails neutralization, so the exact injection point is unverified. Per the CPE entry (cpe:2.3:a:publishpress:publishpress_authors), every release up to and including 4.17.0 is in scope; the reporting source is Patchstack and the classification tags are XSS and PublishPress Authors.
Know when Publishpress Authors gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Stored XSS needs an authenticated low-privilege account to inject (PR:L) and a victim to render it (UI:R); execution in another user's context gives S:C with Low C/I/A.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB