CVE-2026-111592
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter (mapped to display_name) in versions up to and including 4.17.0 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or higher can inject arbitrary scripts that execute when a user visits the injected page. Exploitation requires the attacker's account to have a mapped author term, which is not present by default for new users.
Risk Assessment
This can lead to session hijacking, account takeover, or content modification by a low-privileged attacker. Organizations using this plugin are exposed to XSS attacks targeting users and administrators.
Recommendation
Update the PublishPress Authors plugin to a version later than 4.17.0. Additionally, consider restricting author assignment capabilities and regularly reviewing user permissions.
Other vulnerabilities in PublishPress Authors
See all- CVE-2026-115610Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the PublishPress Authors plugin allows Stored XSS. This issue affects PublishPress Authors through version 4.17.0.
- CVE-2026-85657Medium
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profile_fields_user_email_value_prefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on a link.
Original NVD description (English source)
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (maps to display_name)' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker's user account to have a mapped author term, which occurs when an administrator has assigned them as a co-author on content or has enabled automatic author term creation for their role — this mapping is not present by default for new users on a stock install.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS