PublishPress Future EUVD-2026-100878

Exploitation requires an authenticated user holding the WordPress Contributor role or higher on a site running this plugin before version 4.10.6, who submits the plugin's shortcode with a crafted attribute (the plugin fails to enforce a safe HTML-element allowlist and does not neutralize attacker-controlled text inside the resulting element). Payload execution is gated on a higher-privileged user (e.g., Editor/Administrator) subsequently viewing the stored content - this required user interaction (UI:R) and the need for a pre-existing low-trust account are the principal limiting factors. The attack is therefore confined to multi-author/multi-role deployments and does not affect single-admin sites with no untrusted contributors.

This is a moderate-priority stored XSS (CWE-79) whose signals mostly align toward limited, non-urgent risk. The CVSS base score of 6.8 with vector AV:N/AC:L/PR:H/UI:R reflects network reach and low complexity but requires both an authenticated attacker and a victim who views the malicious content (UI:R), so it is not a drive-by, unauthenticated flaw. EPSS is very low (0.18%, 8th percentile) and CISA SSVC marks Exploitation as 'none' and Automatable as 'no', which is consistent with no KEV listing - meaning no evidence of active exploitation despite a publicly available WPScan proof-of-concept. Two internal inconsistencies should be verified: (1) the vendor vector sets PR:H, yet the description states the attacker only needs the Contributor role, which in WordPress is a LOW-privilege role - PR:L is more defensible, which would slightly raise real-world reachability; and (2) the impact metrics C:H/I:H/A:H are unusually high for an XSS and appear to model full compromise of a higher-privileged (admin) session rather than the plugin itself - SSVC 'Technical Impact: total' supports that reasoning, but standard XSS impact scoring is typically lower. Net: a real but contained privilege-escalation-via-stored-XSS issue requiring an existing low-trust account, not a widespread remote threat.

A low-trust Contributor on a multi-author WordPress site submits a draft post containing the plugin's shortcode with a crafted attribute that smuggles an unsanitized HTML element and attacker-controlled script text. When an Editor or Administrator opens that content to review or publish it, the JavaScript executes in their authenticated session, allowing actions such as creating rogue admin accounts or altering site content. A public proof-of-concept exists (WPScan), lowering the effort to reproduce.