Publishpress
Monthly
Privilege escalation in the PublishPress Capabilities WordPress plugin (slug capability-manager-enhanced) up to and including version 2.45.0 lets an attacker who already holds an elevated authenticated role use the plugin's role/capability management functions to grant themselves capabilities they should not receive, potentially reaching full site compromise (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The dominant risk-limiting factor is the PR:H prerequisite: the actor must already possess a high-privilege role, so sites that reserve such roles for fully trusted administrators face substantially reduced real-world exposure. No public exploit code has been identified at time of analysis, and the flaw is not reported as actively exploited in the provided intelligence.
Cross-site request forgery in PublishPress Capabilities 2.50.1 and earlier lets an attacker lure a logged-in, sufficiently privileged WordPress user into silently submitting role- and capability-modification requests, producing unauthorized permission changes with high integrity impact. The published CVSS 8.1 reflects PR:N/UI:R, but the independent assessment scores the same flaw as C:N/I:H/A:N, giving a materially lower effective severity: exploitation is not self-driven, it requires an authenticated administrative victim to interact with attacker-controlled content during an active session. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and the issue should be treated as moderate priority despite the headline score.
SQL injection in PublishPress Series (also distributed as Organize Series) 3.1.3 and earlier lets an authenticated WordPress Administrator run arbitrary SQL through the plugin's admin-side functionality, allowing read access to the WordPress database and limited modification of its contents. Exploitation requires a logged-in account with Administrator privileges (PR:H), needs no user interaction (UI:N), and no public exploit code was identified at the time of analysis. Because a WordPress Administrator already holds broad database and site control, the practical incremental risk is low even though the CVSS base score is high.
Privilege escalation in PublishPress Capabilities WordPress plugin (all versions ≤2.50.0) allows authenticated Editor-level users to elevate to site-wide capability managers without administrator consent. The root cause is a hard-coded role assignment in `addPluginCapabilities()` that unconditionally grants the Editor role all 15 `manage_capabilities_*` capabilities on the first `admin_init` hook after plugin activation, writing the grants persistently to the WordPress database. Once escalated, an Editor can create, rename, and delete non-system roles; modify capabilities of non-administrator roles; restore role backups; and write arbitrary plugin options under several namespaced prefixes - stopping short of full Administrator access only because WordPress's `map_meta_cap` layer blocks further escalation. No public exploit or CISA KEV listing identified at time of analysis.
Editor-level privilege escalation in the PublishPress Capabilities WordPress plugin (versions ≤ 2.45.0) enables authenticated users holding an Editor role to exceed their intended permission boundary and gain unauthorized elevated capabilities. The root cause is incorrect privilege assignment (CWE-266) within the plugin's capability management logic, and with a CVSS base score of 7.2 (High) reflecting high impact across confidentiality, integrity, and availability, the flaw is most dangerous on multi-tenant or agency WordPress sites where Editor accounts are distributed to semi-trusted users. No public exploit code or CISA KEV listing has been identified at time of analysis.
A blind SQL injection vulnerability exists in the PublishPress Revisions WordPress plugin through version 3.7.23, allowing attackers to execute arbitrary SQL commands against the underlying database. The vulnerability affects all installations of PublishPress Revisions up to and including version 3.7.23, enabling attackers to extract sensitive data, modify database contents, or potentially achieve remote code execution depending on database permissions and WordPress configuration. No CVSS score or EPSS data is currently available, and KEV status is unknown, though the vulnerability has been documented by Patchstack security researchers with a public reference available.
A missing authorization vulnerability in PublishPress Authors plugin versions up to 4.10.1 allows attackers to exploit incorrectly configured access control security levels, potentially bypassing authentication mechanisms. This vulnerability affects WordPress installations using the PublishPress Authors plugin and could enable unauthorized users to perform actions they should not be permitted to execute. The vulnerability is classified as an authentication bypass issue with CWE-862 (Missing Authorization), though specific CVSS scoring and exploitation data are not yet published.
Stored cross-site scripting (CVSS 6.5, CWE-79) in the PublishPress Authors WordPress plugin affects all versions through 4.17.0 and lets an authenticated low-privilege user plant script content that executes in the browser of any higher-privileged user - typically an editor or administrator - who later views the affected author screen. Exploitation needs a valid low-privilege account (PR:L) plus victim interaction with the rendered payload (UI:R), so it is a post-authentication, second-party-triggered issue rather than an unauthenticated attack; scope is marked changed (S:C), with low confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the available signals place this as a moderate, non-emergency item to schedule within the normal monthly patch cadence.
Stored cross-site scripting (XSS) in the WordPress plugin PublishPress Future before 4.10.6 allows an authenticated attacker with Contributor or higher privileges to inject JavaScript that executes when a higher-privileged user views the affected content. Publicly available exploit code exists, but no KEV entry is provided, so active exploitation is not confirmed; EPSS is low at 0.18% (8th percentile), and the independent assessment treats this as a moderate-priority issue limited to multi-author sites with untrusted contributors. The required victim interaction and need for a pre-existing low-trust account are the main limiting factors.
An authenticated authorization bypass (IDOR) in the PublishPress Series WordPress plugin (organize-series), affecting versions through 3.1.3, lets a low-privileged logged-in user supply an attacker-chosen object key to reach and manipulate series resources that belong to other users. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), meaning impact is limited to partial integrity and availability with no confidentiality loss, and exploitation requires a valid low-privilege account on a site running the vulnerable plugin. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is moderate and depends on whether the site permits self-registration or otherwise grants untrusted users low-privilege accounts.
Cross-site request forgery in PublishPress Series (versions up to and including 3.1.3) allows an unauthenticated attacker to trick an authenticated WordPress user with sufficient privileges - typically an administrator or editor - into submitting unintended state-changing requests to the plugin while their WordPress session is active. Because the affected action lacks nonce/CSRF token validation, the impact is confined to low-integrity and low-availability changes within the plugin's own scope (S:U), with no data disclosure or server-side authentication bypass; success depends entirely on social-engineering the victim into visiting an attacker-controlled page. No public exploit code or active exploitation has been identified at time of analysis, and this is a moderate-severity, not high-priority issue (CVSS 5.4, CWE-352, Patchstack-reported, tracked as EUVD-2026-81516).
Stored cross-site scripting in the PublishPress Series WordPress plugin affects all versions through 3.1.3, allowing an authenticated user with Contributor-level access to plant script-bearing content that executes in a higher-privileged user's browser when that user views the affected series. Exploitation requires both a Contributor account and victim interaction (an administrator or editor opening the poisoned content), and it is scored CVSS 6.5 because the payload runs in the privileged user's session context. No public exploit code has been identified at time of analysis, and no CISA KEV or EPSS signal was provided.
Stored XSS in the PublishPress Authors WordPress plugin (all versions through 4.15.0) allows authenticated users holding Author-level access or above to inject persistent malicious scripts via the `profile_fields_user_email_value_prefix` parameter in author box configuration. The injected payload executes in the browser of any site user who clicks the affected author box link, enabling session hijacking, credential theft, or admin account takeover through the browser context of higher-privileged victims. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated IDOR in PublishPress Permissions WordPress plugin versions 4.8.3 and below allows remote attackers to access restricted content objects by manipulating user-controlled identifiers in requests. The flaw (CWE-639) bypasses the plugin's content access controls without any credentials, exposing data that should be permission-gated. CVSS 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability risk; no public exploit or KEV listing identified at time of analysis.
Stored cross-site scripting (XSS) in PublishPress Future WordPress plugin versions up to 4.10.0 allows authenticated administrators to inject arbitrary JavaScript via the 'wrapper' attribute of the [futureaction] shortcode, which executes in the browsers of all users viewing the affected page. The vulnerability stems from insufficient sanitization: the plugin uses esc_html() to escape the attribute value but then passes it as a bare HTML tag name in a sprintf() call, permitting event handler injection through spaces. Since administrators can delegate this functionality to lower-privileged contributors, the attack surface extends beyond high-privilege users.
DOM-based cross-site scripting (XSS) in PublishPress Post Expirator WordPress plugin versions 4.9.4 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of higher-privileged administrators viewing affected pages, potentially leading to unauthorized actions or credential theft. The vulnerability requires user interaction (administrator viewing the malicious content) and is confined to the application context, making it a medium-severity risk despite the high CVSS score-EPSS scoring of 0.03% percentile indicates low real-world exploitation probability.
PublishPress Capabilities versions up to 2.31.0 contain an authorization bypass that allows authenticated users to exploit misconfigured access controls and gain unauthorized information disclosure. An attacker with valid credentials could leverage this vulnerability to access sensitive data they are not permitted to view. No patch is currently available for this vulnerability.
The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Privilege escalation in the PublishPress Capabilities WordPress plugin (slug capability-manager-enhanced) up to and including version 2.45.0 lets an attacker who already holds an elevated authenticated role use the plugin's role/capability management functions to grant themselves capabilities they should not receive, potentially reaching full site compromise (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The dominant risk-limiting factor is the PR:H prerequisite: the actor must already possess a high-privilege role, so sites that reserve such roles for fully trusted administrators face substantially reduced real-world exposure. No public exploit code has been identified at time of analysis, and the flaw is not reported as actively exploited in the provided intelligence.
Cross-site request forgery in PublishPress Capabilities 2.50.1 and earlier lets an attacker lure a logged-in, sufficiently privileged WordPress user into silently submitting role- and capability-modification requests, producing unauthorized permission changes with high integrity impact. The published CVSS 8.1 reflects PR:N/UI:R, but the independent assessment scores the same flaw as C:N/I:H/A:N, giving a materially lower effective severity: exploitation is not self-driven, it requires an authenticated administrative victim to interact with attacker-controlled content during an active session. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and the issue should be treated as moderate priority despite the headline score.
SQL injection in PublishPress Series (also distributed as Organize Series) 3.1.3 and earlier lets an authenticated WordPress Administrator run arbitrary SQL through the plugin's admin-side functionality, allowing read access to the WordPress database and limited modification of its contents. Exploitation requires a logged-in account with Administrator privileges (PR:H), needs no user interaction (UI:N), and no public exploit code was identified at the time of analysis. Because a WordPress Administrator already holds broad database and site control, the practical incremental risk is low even though the CVSS base score is high.
Privilege escalation in PublishPress Capabilities WordPress plugin (all versions ≤2.50.0) allows authenticated Editor-level users to elevate to site-wide capability managers without administrator consent. The root cause is a hard-coded role assignment in `addPluginCapabilities()` that unconditionally grants the Editor role all 15 `manage_capabilities_*` capabilities on the first `admin_init` hook after plugin activation, writing the grants persistently to the WordPress database. Once escalated, an Editor can create, rename, and delete non-system roles; modify capabilities of non-administrator roles; restore role backups; and write arbitrary plugin options under several namespaced prefixes - stopping short of full Administrator access only because WordPress's `map_meta_cap` layer blocks further escalation. No public exploit or CISA KEV listing identified at time of analysis.
Editor-level privilege escalation in the PublishPress Capabilities WordPress plugin (versions ≤ 2.45.0) enables authenticated users holding an Editor role to exceed their intended permission boundary and gain unauthorized elevated capabilities. The root cause is incorrect privilege assignment (CWE-266) within the plugin's capability management logic, and with a CVSS base score of 7.2 (High) reflecting high impact across confidentiality, integrity, and availability, the flaw is most dangerous on multi-tenant or agency WordPress sites where Editor accounts are distributed to semi-trusted users. No public exploit code or CISA KEV listing has been identified at time of analysis.
A blind SQL injection vulnerability exists in the PublishPress Revisions WordPress plugin through version 3.7.23, allowing attackers to execute arbitrary SQL commands against the underlying database. The vulnerability affects all installations of PublishPress Revisions up to and including version 3.7.23, enabling attackers to extract sensitive data, modify database contents, or potentially achieve remote code execution depending on database permissions and WordPress configuration. No CVSS score or EPSS data is currently available, and KEV status is unknown, though the vulnerability has been documented by Patchstack security researchers with a public reference available.
A missing authorization vulnerability in PublishPress Authors plugin versions up to 4.10.1 allows attackers to exploit incorrectly configured access control security levels, potentially bypassing authentication mechanisms. This vulnerability affects WordPress installations using the PublishPress Authors plugin and could enable unauthorized users to perform actions they should not be permitted to execute. The vulnerability is classified as an authentication bypass issue with CWE-862 (Missing Authorization), though specific CVSS scoring and exploitation data are not yet published.
Stored cross-site scripting (CVSS 6.5, CWE-79) in the PublishPress Authors WordPress plugin affects all versions through 4.17.0 and lets an authenticated low-privilege user plant script content that executes in the browser of any higher-privileged user - typically an editor or administrator - who later views the affected author screen. Exploitation needs a valid low-privilege account (PR:L) plus victim interaction with the rendered payload (UI:R), so it is a post-authentication, second-party-triggered issue rather than an unauthenticated attack; scope is marked changed (S:C), with low confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the available signals place this as a moderate, non-emergency item to schedule within the normal monthly patch cadence.
Stored cross-site scripting (XSS) in the WordPress plugin PublishPress Future before 4.10.6 allows an authenticated attacker with Contributor or higher privileges to inject JavaScript that executes when a higher-privileged user views the affected content. Publicly available exploit code exists, but no KEV entry is provided, so active exploitation is not confirmed; EPSS is low at 0.18% (8th percentile), and the independent assessment treats this as a moderate-priority issue limited to multi-author sites with untrusted contributors. The required victim interaction and need for a pre-existing low-trust account are the main limiting factors.
An authenticated authorization bypass (IDOR) in the PublishPress Series WordPress plugin (organize-series), affecting versions through 3.1.3, lets a low-privileged logged-in user supply an attacker-chosen object key to reach and manipulate series resources that belong to other users. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), meaning impact is limited to partial integrity and availability with no confidentiality loss, and exploitation requires a valid low-privilege account on a site running the vulnerable plugin. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is moderate and depends on whether the site permits self-registration or otherwise grants untrusted users low-privilege accounts.
Cross-site request forgery in PublishPress Series (versions up to and including 3.1.3) allows an unauthenticated attacker to trick an authenticated WordPress user with sufficient privileges - typically an administrator or editor - into submitting unintended state-changing requests to the plugin while their WordPress session is active. Because the affected action lacks nonce/CSRF token validation, the impact is confined to low-integrity and low-availability changes within the plugin's own scope (S:U), with no data disclosure or server-side authentication bypass; success depends entirely on social-engineering the victim into visiting an attacker-controlled page. No public exploit code or active exploitation has been identified at time of analysis, and this is a moderate-severity, not high-priority issue (CVSS 5.4, CWE-352, Patchstack-reported, tracked as EUVD-2026-81516).
Stored cross-site scripting in the PublishPress Series WordPress plugin affects all versions through 3.1.3, allowing an authenticated user with Contributor-level access to plant script-bearing content that executes in a higher-privileged user's browser when that user views the affected series. Exploitation requires both a Contributor account and victim interaction (an administrator or editor opening the poisoned content), and it is scored CVSS 6.5 because the payload runs in the privileged user's session context. No public exploit code has been identified at time of analysis, and no CISA KEV or EPSS signal was provided.
Stored XSS in the PublishPress Authors WordPress plugin (all versions through 4.15.0) allows authenticated users holding Author-level access or above to inject persistent malicious scripts via the `profile_fields_user_email_value_prefix` parameter in author box configuration. The injected payload executes in the browser of any site user who clicks the affected author box link, enabling session hijacking, credential theft, or admin account takeover through the browser context of higher-privileged victims. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated IDOR in PublishPress Permissions WordPress plugin versions 4.8.3 and below allows remote attackers to access restricted content objects by manipulating user-controlled identifiers in requests. The flaw (CWE-639) bypasses the plugin's content access controls without any credentials, exposing data that should be permission-gated. CVSS 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability risk; no public exploit or KEV listing identified at time of analysis.
Stored cross-site scripting (XSS) in PublishPress Future WordPress plugin versions up to 4.10.0 allows authenticated administrators to inject arbitrary JavaScript via the 'wrapper' attribute of the [futureaction] shortcode, which executes in the browsers of all users viewing the affected page. The vulnerability stems from insufficient sanitization: the plugin uses esc_html() to escape the attribute value but then passes it as a bare HTML tag name in a sprintf() call, permitting event handler injection through spaces. Since administrators can delegate this functionality to lower-privileged contributors, the attack surface extends beyond high-privilege users.
DOM-based cross-site scripting (XSS) in PublishPress Post Expirator WordPress plugin versions 4.9.4 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of higher-privileged administrators viewing affected pages, potentially leading to unauthorized actions or credential theft. The vulnerability requires user interaction (administrator viewing the malicious content) and is confined to the application context, making it a medium-severity risk despite the high CVSS score-EPSS scoring of 0.03% percentile indicates low real-world exploitation probability.
PublishPress Capabilities versions up to 2.31.0 contain an authorization bypass that allows authenticated users to exploit misconfigured access controls and gain unauthorized information disclosure. An attacker with valid credentials could leverage this vulnerability to access sensitive data they are not permitted to view. No patch is currently available for this vulnerability.
The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.