CVE-2026-115610
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the PublishPress Authors plugin allows Stored XSS. This issue affects PublishPress Authors through version 4.17.0.
Risk Assessment
An attacker can inject a malicious script that executes in site users' browsers, potentially leading to session theft or actions performed on behalf of victims.
Recommendation
Update the PublishPress Authors plugin to a version newer than 4.17.0.
Other vulnerabilities in PublishPress Authors
See all- CVE-2026-111592Medium
The PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter (mapped to display_name) in versions up to and including 4.17.0 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or higher can inject arbitrary scripts that execute when a user visits the injected page. Exploitation requires the attacker's account to have a mapped author term, which is not present by default for new users.
- CVE-2026-85657Medium
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profile_fields_user_email_value_prefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on a link.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS