Publishpress Authors
Monthly
A missing authorization vulnerability in PublishPress Authors plugin versions up to 4.10.1 allows attackers to exploit incorrectly configured access control security levels, potentially bypassing authentication mechanisms. This vulnerability affects WordPress installations using the PublishPress Authors plugin and could enable unauthorized users to perform actions they should not be permitted to execute. The vulnerability is classified as an authentication bypass issue with CWE-862 (Missing Authorization), though specific CVSS scoring and exploitation data are not yet published.
Stored cross-site scripting (CVSS 6.5, CWE-79) in the PublishPress Authors WordPress plugin affects all versions through 4.17.0 and lets an authenticated low-privilege user plant script content that executes in the browser of any higher-privileged user - typically an editor or administrator - who later views the affected author screen. Exploitation needs a valid low-privilege account (PR:L) plus victim interaction with the rendered payload (UI:R), so it is a post-authentication, second-party-triggered issue rather than an unauthenticated attack; scope is marked changed (S:C), with low confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the available signals place this as a moderate, non-emergency item to schedule within the normal monthly patch cadence.
A missing authorization vulnerability in PublishPress Authors plugin versions up to 4.10.1 allows attackers to exploit incorrectly configured access control security levels, potentially bypassing authentication mechanisms. This vulnerability affects WordPress installations using the PublishPress Authors plugin and could enable unauthorized users to perform actions they should not be permitted to execute. The vulnerability is classified as an authentication bypass issue with CWE-862 (Missing Authorization), though specific CVSS scoring and exploitation data are not yet published.
Stored cross-site scripting (CVSS 6.5, CWE-79) in the PublishPress Authors WordPress plugin affects all versions through 4.17.0 and lets an authenticated low-privilege user plant script content that executes in the browser of any higher-privileged user - typically an editor or administrator - who later views the affected author screen. Exploitation needs a valid low-privilege account (PR:L) plus victim interaction with the rendered payload (UI:R), so it is a post-authentication, second-party-triggered issue rather than an unauthenticated attack; scope is marked changed (S:C), with low confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the available signals place this as a moderate, non-emergency item to schedule within the normal monthly patch cadence.