Publishpress vulnerabilities
33 CVEs and advisories name Publishpress as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-120851WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability
- CVE-2026-111592Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored…
- CVE-2026-115610WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-48197WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
- CVE-2026-39444WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-94487WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-74005WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-66630WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability
- CVE-2026-66617WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-85657Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter
- CVE-2026-75927PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant
- CVE-2026-84771WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-27365WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28183WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
- CVE-2026-5247Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute
- CVE-2026-39482WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32539WordPress PublishPress Revisions plugin <= 3.7.23 - SQL Injection vulnerability
- CVE-2026-25309WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability
- CVE-2026-32394WordPress PublishPress Capabilities plugin <= 2.31.0 - Broken Access Control vulnerability
- CVE-2026-25330WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability
- CVE-2026-25322WordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2025-14718Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation
- CVE-2025-69361WordPress Post Expirator plugin <= 4.9.3 - Broken Access Control vulnerability
- CVE-2025-13741Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) Authors' Emails Exposure
- CVE-2025-13149Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification
- CVE-2025-8588Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2025-48332WordPress Gutenberg Blocks <= 3.3.1 - Local File Inclusion Vulnerability
- CVE-2025-49032WordPress Gutenberg Blocks plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-47496WordPress PublishPress Authors plugin <= 4.7.5 - Local File Inclusion Vulnerability
- CVE-2025-26886WordPress PublishPress Authors plugin <= 4.7.3 - SQL Injection vulnerability