Publishpress Series
Monthly
SQL injection in PublishPress Series (also distributed as Organize Series) 3.1.3 and earlier lets an authenticated WordPress Administrator run arbitrary SQL through the plugin's admin-side functionality, allowing read access to the WordPress database and limited modification of its contents. Exploitation requires a logged-in account with Administrator privileges (PR:H), needs no user interaction (UI:N), and no public exploit code was identified at the time of analysis. Because a WordPress Administrator already holds broad database and site control, the practical incremental risk is low even though the CVSS base score is high.
An authenticated authorization bypass (IDOR) in the PublishPress Series WordPress plugin (organize-series), affecting versions through 3.1.3, lets a low-privileged logged-in user supply an attacker-chosen object key to reach and manipulate series resources that belong to other users. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), meaning impact is limited to partial integrity and availability with no confidentiality loss, and exploitation requires a valid low-privilege account on a site running the vulnerable plugin. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is moderate and depends on whether the site permits self-registration or otherwise grants untrusted users low-privilege accounts.
Cross-site request forgery in PublishPress Series (versions up to and including 3.1.3) allows an unauthenticated attacker to trick an authenticated WordPress user with sufficient privileges - typically an administrator or editor - into submitting unintended state-changing requests to the plugin while their WordPress session is active. Because the affected action lacks nonce/CSRF token validation, the impact is confined to low-integrity and low-availability changes within the plugin's own scope (S:U), with no data disclosure or server-side authentication bypass; success depends entirely on social-engineering the victim into visiting an attacker-controlled page. No public exploit code or active exploitation has been identified at time of analysis, and this is a moderate-severity, not high-priority issue (CVSS 5.4, CWE-352, Patchstack-reported, tracked as EUVD-2026-81516).
Stored cross-site scripting in the PublishPress Series WordPress plugin affects all versions through 3.1.3, allowing an authenticated user with Contributor-level access to plant script-bearing content that executes in a higher-privileged user's browser when that user views the affected series. Exploitation requires both a Contributor account and victim interaction (an administrator or editor opening the poisoned content), and it is scored CVSS 6.5 because the payload runs in the privileged user's session context. No public exploit code has been identified at time of analysis, and no CISA KEV or EPSS signal was provided.
SQL injection in PublishPress Series (also distributed as Organize Series) 3.1.3 and earlier lets an authenticated WordPress Administrator run arbitrary SQL through the plugin's admin-side functionality, allowing read access to the WordPress database and limited modification of its contents. Exploitation requires a logged-in account with Administrator privileges (PR:H), needs no user interaction (UI:N), and no public exploit code was identified at the time of analysis. Because a WordPress Administrator already holds broad database and site control, the practical incremental risk is low even though the CVSS base score is high.
An authenticated authorization bypass (IDOR) in the PublishPress Series WordPress plugin (organize-series), affecting versions through 3.1.3, lets a low-privileged logged-in user supply an attacker-chosen object key to reach and manipulate series resources that belong to other users. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), meaning impact is limited to partial integrity and availability with no confidentiality loss, and exploitation requires a valid low-privilege account on a site running the vulnerable plugin. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is moderate and depends on whether the site permits self-registration or otherwise grants untrusted users low-privilege accounts.
Cross-site request forgery in PublishPress Series (versions up to and including 3.1.3) allows an unauthenticated attacker to trick an authenticated WordPress user with sufficient privileges - typically an administrator or editor - into submitting unintended state-changing requests to the plugin while their WordPress session is active. Because the affected action lacks nonce/CSRF token validation, the impact is confined to low-integrity and low-availability changes within the plugin's own scope (S:U), with no data disclosure or server-side authentication bypass; success depends entirely on social-engineering the victim into visiting an attacker-controlled page. No public exploit code or active exploitation has been identified at time of analysis, and this is a moderate-severity, not high-priority issue (CVSS 5.4, CWE-352, Patchstack-reported, tracked as EUVD-2026-81516).
Stored cross-site scripting in the PublishPress Series WordPress plugin affects all versions through 3.1.3, allowing an authenticated user with Contributor-level access to plant script-bearing content that executes in a higher-privileged user's browser when that user views the affected series. Exploitation requires both a Contributor account and victim interaction (an administrator or editor opening the poisoned content), and it is scored CVSS 6.5 because the payload runs in the privileged user's session context. No public exploit code has been identified at time of analysis, and no CISA KEV or EPSS signal was provided.