PublishPress Authors CVE-2026-85657

Requires a valid WordPress account with at minimum Author-level role on the target site; Contributor-level or higher also applies per the disclosure. The attacker must be able to save author box settings containing the profile_fields_user_email_value_prefix parameter - this capability is inherent to the Author role in the PublishPress Authors plugin. The victim must visit a page rendering the attacker's author box and actively click the email-prefix link (UI:R). The PublishPress Authors plugin must be installed and active at version 4.15.0 or earlier. Exploitation is limited by: the requirement for a pre-existing Author-level account (no unauthenticated path), the need for victim click interaction (not a passive page-load trigger), and deployment on sites running the specific affected plugin version. Sites with only administrator accounts or where Author-level users are all trusted internal staff have minimal realistic exposure.

The CVSS 5.4 (Medium) score is well-calibrated for this vulnerability class. PR:L reflects the mandatory Author-level WordPress account, which limits the attack surface to sites with multiple registered contributors - a common configuration for editorial or multi-author blogs. UI:R (user must click the email link) reduces opportunistic exploitation but does not prevent targeted attacks. The critical risk amplifier is the Scope Changed (S:C) metric: an Author can plant a payload that executes in an Administrator's browser, enabling privilege escalation via XSS-driven admin takeover, nonce hijacking, or plugin installation. Without a KEV listing and no identified POC, this is a realistic but not actively weaponized threat; real-world priority is elevated for WordPress sites that grant Author or Contributor access to untrusted or externally recruited writers. EPSS data was not provided in the input and cannot be cited.

An attacker registered as an Author on a multi-contributor WordPress blog edits their author box settings and injects a JavaScript payload (such as an image onerror handler or script tag) into the profile_fields_user_email_value_prefix field. When a site administrator reviews the author's published article or any page displaying the author box and clicks the email prefix link, the stored script fires in the administrator's browser, silently issuing an authenticated admin request to create a new administrator account or install a backdoor plugin. No public POC has been identified, but the attack pattern is well-understood for stored XSS in WordPress author metadata.