CVE-2026-27365
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series from n/a through 2.17.0.
Risk Assessment
An attacker can inject a malicious script that executes in the administrator's browser, potentially leading to session theft, defacement, or other damage.
Recommendation
Update the PublishPress Series plugin to a version newer than 2.17.0 if available, or apply other XSS protection measures.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0.