PublishPress Series CVE-2026-66617

Exploitation requires an authenticated WordPress account with at least Contributor role on a site running PublishPress Series <= 3.1.3 (PR:L). It further requires user interaction (UI:R): a higher-privileged user such as an administrator or editor must view the attacker-supplied series content for the stored payload to execute. Limiting factors: the site must permit Contributor-level (or higher) accounts to untrusted parties, and the payload only yields impact when rendered in a privileged victim's browser. Not remotely exploitable without authentication and not effective against sites that restrict contributor accounts to trusted staff.

This is a moderate-severity, low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) shows network reachability and low attack complexity, but two factors constrain real-world risk: PR:L requires an authenticated Contributor-level account, and UI:R requires a victim (typically an editor/administrator) to view the poisoned content before the payload fires. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is a plausible-but-not-hot finding rather than an active threat. The S:C scope change (stored XSS executing in the browser context of higher-privileged users) is the main reason the score is elevated above a typical self-XSS. There is no conflict between the CVSS vector and the description: both indicate an authenticated, low-privilege, contributor-driven stored XSS. Net: patch on a normal cycle, not an emergency, unless the site grants Contributor accounts to untrusted users.

An attacker who holds (or registers/obtains) a Contributor account on a WordPress site running PublishPress Series <= 3.1.3 injects a malicious script payload into a series field that is not properly sanitized. When an administrator or editor later views the series content in the dashboard, the stored script executes in their authenticated browser session, enabling actions such as creating a rogue admin or hijacking the session. No public exploit code is identified at the time of analysis.