What is the CVSS score of CVE-2026-5247?

CVE-2026-5247 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

PublishPress Future CVE-2026-5247

EUVD-2026-27191 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-05 Wordfence

WordPress XSS Wordpress Plugin Schedule Post Changes With Publishpress Future Publishpress

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 03:30 vuln.today

DescriptionCVE.org

The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper' attribute of the [futureaction] shortcode in all versions up to, and including, 4.10.0. This is due to insufficient input sanitization on the wrapper attribute. The plugin uses esc_html() to escape the value, but esc_html() only encodes HTML entities and does not prevent attribute injection when the value is used as an HTML tag name in a sprintf() call. An attacker can inject event handler attributes via spaces in the wrapper value. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Since it is also possible for administrators to make this functionality available to lower-privileged users, this introduces the possibility of abuse by contributors.

AnalysisAI

Stored cross-site scripting (XSS) in PublishPress Future WordPress plugin versions up to 4.10.0 allows authenticated administrators to inject arbitrary JavaScript via the 'wrapper' attribute of the [futureaction] shortcode, which executes in the browsers of all users viewing the affected page. The vulnerability stems from insufficient sanitization: the plugin uses esc_html() to escape the attribute value but then passes it as a bare HTML tag name in a sprintf() call, permitting event handler injection through spaces. Since administrators can delegate this functionality to lower-privileged contributors, the attack surface extends beyond high-privilege users.

Technical ContextAI

The [futureaction] shortcode accepts a 'wrapper' parameter intended to define an HTML element type (e.g., 'div', 'span'). The plugin applies esc_html() to the user-supplied wrapper value, which encodes HTML entity characters (<, >, &, ", ') but does not prevent whitespace or attribute injection. The sanitized value is then used directly in a sprintf() call to construct an opening HTML tag, e.g., sprintf('<%s class="...">', $wrapper). An attacker can inject a value like 'div onclick=alert(1)' which, after esc_html() escapes any entity-encodable characters (of which there are none in this payload), becomes 'div onclick=alert(1)' in the rendered output. This results in a tag like '<div onclick=alert(1) class="...">' - a valid HTML injection vector. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the failure to account for the context in which the escaped value is used. esc_html() is insufficient when the input becomes an unquoted attribute context.

RemediationAI

Update PublishPress Future to version 4.10.1 or later immediately. The plugin developer has released patched versions that implement proper output escaping for the 'wrapper' attribute, using functions appropriate for the attribute context (such as esc_attr() for tag attributes in addition to or instead of esc_html()). Administrators should audit any [futureaction] shortcodes in published content and pages to confirm they do not contain suspicious or unexpected wrapper values. If you have delegated shortcode creation or editing permissions to contributors or authors, restrict that delegation to trusted staff members only, or implement a code review process for shortcode usage. If immediate patching is not possible, disable the [futureaction] shortcode functionality until updates can be applied, or prevent lower-privilege users from creating or editing shortcodes in general via role management. Note that disabling the shortcode may affect scheduling features for post expiration, so test in a staging environment first.