Schedule Post Changes With Publishpress Future
Monthly
Stored cross-site scripting (XSS) in the WordPress plugin PublishPress Future before 4.10.6 allows an authenticated attacker with Contributor or higher privileges to inject JavaScript that executes when a higher-privileged user views the affected content. Publicly available exploit code exists, but no KEV entry is provided, so active exploitation is not confirmed; EPSS is low at 0.18% (8th percentile), and the independent assessment treats this as a moderate-priority issue limited to multi-author sites with untrusted contributors. The required victim interaction and need for a pre-existing low-trust account are the main limiting factors.
Stored cross-site scripting (XSS) in PublishPress Future WordPress plugin versions up to 4.10.0 allows authenticated administrators to inject arbitrary JavaScript via the 'wrapper' attribute of the [futureaction] shortcode, which executes in the browsers of all users viewing the affected page. The vulnerability stems from insufficient sanitization: the plugin uses esc_html() to escape the attribute value but then passes it as a bare HTML tag name in a sprintf() call, permitting event handler injection through spaces. Since administrators can delegate this functionality to lower-privileged contributors, the attack surface extends beyond high-privilege users.
Stored cross-site scripting (XSS) in the WordPress plugin PublishPress Future before 4.10.6 allows an authenticated attacker with Contributor or higher privileges to inject JavaScript that executes when a higher-privileged user views the affected content. Publicly available exploit code exists, but no KEV entry is provided, so active exploitation is not confirmed; EPSS is low at 0.18% (8th percentile), and the independent assessment treats this as a moderate-priority issue limited to multi-author sites with untrusted contributors. The required victim interaction and need for a pre-existing low-trust account are the main limiting factors.
Stored cross-site scripting (XSS) in PublishPress Future WordPress plugin versions up to 4.10.0 allows authenticated administrators to inject arbitrary JavaScript via the 'wrapper' attribute of the [futureaction] shortcode, which executes in the browsers of all users viewing the affected page. The vulnerability stems from insufficient sanitization: the plugin uses esc_html() to escape the attribute value but then passes it as a bare HTML tag name in a sprintf() call, permitting event handler injection through spaces. Since administrators can delegate this functionality to lower-privileged contributors, the attack surface extends beyond high-privilege users.