CVE-2026-105261

MediumCVSS 6.8

Published: 14/10/2026(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The Schedule Post Changes With PublishPress Future WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content.

Risk Assessment

Attackers with low privileges can hijack administrator sessions, potentially leading to full site compromise. Malware can also be spread to visitors.

Recommendation

Update the PublishPress Future plugin to version 4.10.6 or later, which enforces a safe HTML element allowlist. Additionally, restrict roles that can use the shortcode.

Other vulnerabilities in PublishPress Future

CVE-2025-13149Medium
The Schedule Post Changes With PublishPress Future plugin for WordPress in versions up to and including 4.9.1 is vulnerable to unauthorized modification of data due to a missing authorization check on the saveFutureActionData function. An authenticated attacker with author-level access or higher can change the status of arbitrary posts and pages via the REST API endpoint.

Original NVD description (English source)

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS