CVE-2026-27365
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series from n/a through 2.17.0.
Risk Assessment
An attacker can inject a malicious script that executes in the administrator's browser, potentially leading to session theft, defacement, or other damage.
Recommendation
Update the PublishPress Series plugin to a version newer than 2.17.0 if available, or apply other XSS protection measures.
Other vulnerabilities in PublishPress Series
See all- CVE-2026-39444Medium
PublishPress Series (WordPress plugin) through version 3.1.3 has an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-74005Medium
Cross Site Request Forgery (CSRF) vulnerability in PublishPress Series plugin up to version 3.1.3. CSRF attacks can be performed without authentication, allowing forced actions on behalf of a logged-in admin.
- CVE-2026-66630High
The PublishPress Series plugin in versions up to and including 3.1.3 contains an Administrator SQL Injection vulnerability. This enables an administrator-level user to inject malicious SQL code into database queries.
- CVE-2026-66617Medium
Cross Site Scripting (XSS) vulnerability in PublishPress Series plugin up to version 3.1.3, affecting Contributor accounts. It allows injection of malicious JavaScript into publication content, which executes in other users' browsers.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS