# cve.now: Publishpress

The newest entries naming Publishpress as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120851](https://cve.now/CVE-2026-120851.md): WordPress PublishPress Revisions plugin \<= 4.2.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-111592](https://cve.now/CVE-2026-111592.md): Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors \<= 4.17.0 - Authenticated (Subscriber+) Stored… (CVSS 6.4)
- [CVE-2026-115610](https://cve.now/CVE-2026-115610.md): WordPress PublishPress Authors plugin \<= 4.17.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-48197](https://cve.now/CVE-2026-48197.md): WordPress PublishPress Capabilities plugin \<= 2.45.0 - Privilege Escalation vulnerability (CVSS 7.2)
- [CVE-2026-39444](https://cve.now/CVE-2026-39444.md): WordPress PublishPress Series plugin \<= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-94487](https://cve.now/CVE-2026-94487.md): WordPress PublishPress Capabilities plugin \<= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.1)
- [CVE-2026-74005](https://cve.now/CVE-2026-74005.md): WordPress PublishPress Series plugin \<= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2026-66630](https://cve.now/CVE-2026-66630.md): WordPress PublishPress Series plugin \<= 3.1.3 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-66617](https://cve.now/CVE-2026-66617.md): WordPress PublishPress Series plugin \<= 3.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-85657](https://cve.now/CVE-2026-85657.md): Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors \<= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile\_fields\_user\_email\_value\_prefix' Parameter (CVSS 5.4)
- [CVE-2026-75927](https://cve.now/CVE-2026-75927.md): PublishPress Capabilities \<= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant (CVSS 7.2)
- [CVE-2026-84771](https://cve.now/CVE-2026-84771.md): WordPress PublishPress Permissions plugin \<= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- [CVE-2026-27365](https://cve.now/CVE-2026-27365.md): WordPress PublishPress Series plugin \<= 2.17.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2026-28183](https://cve.now/CVE-2026-28183.md): WordPress PublishPress Capabilities plugin \<= 2.45.0 - Privilege Escalation vulnerability (CVSS 7.2)
- [CVE-2026-5247](https://cve.now/CVE-2026-5247.md): Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories \<= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute (CVSS 5.5)
- [CVE-2026-39482](https://cve.now/CVE-2026-39482.md): WordPress Post Expirator plugin \<= 4.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-32539](https://cve.now/CVE-2026-32539.md): WordPress PublishPress Revisions plugin \<= 3.7.23 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-25309](https://cve.now/CVE-2026-25309.md): WordPress PublishPress Authors plugin \<= 4.10.1 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-32394](https://cve.now/CVE-2026-32394.md): WordPress PublishPress Capabilities plugin \<= 2.31.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-25330](https://cve.now/CVE-2026-25330.md): WordPress PublishPress Authors plugin \<= 4.10.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-25322](https://cve.now/CVE-2026-25322.md): WordPress PublishPress Revisions plugin \<= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2025-14718](https://cve.now/CVE-2025-14718.md): Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories \<= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation (CVSS 5.4)
- [CVE-2025-69361](https://cve.now/CVE-2025-69361.md): WordPress Post Expirator plugin \<= 4.9.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-13741](https://cve.now/CVE-2025-13741.md): Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories \<= 4.9.2 - Missing Authorization to Authenticated (Contributor+) Authors' Emails Exposure (CVSS 4.3)
- [CVE-2025-13149](https://cve.now/CVE-2025-13149.md): Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories \<= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification (CVSS 4.3)
- [CVE-2025-8588](https://cve.now/CVE-2025-8588.md): Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks \<= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-48332](https://cve.now/CVE-2025-48332.md): WordPress Gutenberg Blocks \<= 3.3.1 - Local File Inclusion Vulnerability (CVSS 7.5)
- [CVE-2025-49032](https://cve.now/CVE-2025-49032.md): WordPress Gutenberg Blocks plugin \<= 3.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-47496](https://cve.now/CVE-2025-47496.md): WordPress PublishPress Authors plugin \<= 4.7.5 - Local File Inclusion Vulnerability (CVSS 7.5)
- [CVE-2025-26886](https://cve.now/CVE-2025-26886.md): WordPress PublishPress Authors plugin \<= 4.7.3 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2024-11154](https://cve.now/CVE-2024-11154.md): PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes \<= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3)
- [CVE-2024-9215](https://cve.now/CVE-2024-9215.md): Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors \<= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover (CVSS 8.8)
- [CVE-2024-9436](https://cve.now/CVE-2024-9436.md): PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes \<= 3.5.14 - Reflected Cross-Site Scripting (CVSS 6.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/publishpress
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.