CVE-2026-85657
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profile_fields_user_email_value_prefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on a link.
Risk Assessment
Session hijacking, data theft, or malware distribution within the context of a trusted site.
Recommendation
Update the PublishPress Authors plugin to a version newer than 4.15.0 that includes sanitization and escaping fixes.
Other vulnerabilities in PublishPress Authors
See all- CVE-2026-111592Medium
The PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter (mapped to display_name) in versions up to and including 4.17.0 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or higher can inject arbitrary scripts that execute when a user visits the injected page. Exploitation requires the attacker's account to have a mapped author term, which is not present by default for new users.
- CVE-2026-115610Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the PublishPress Authors plugin allows Stored XSS. This issue affects PublishPress Authors through version 4.17.0.
Original NVD description (English source)
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profile_fields_user_email_value_prefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS