Publishpress
Vulnerability activity for Publishpress: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 9
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 9
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.4MediumOct 31, 2026Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors XSSCVE-2026-111592The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (maps to display_name)' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
- 6.5MediumOct 29, 2026PublishPress Authors XSSCVE-2026-115610Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.
- 7.2HighOct 6, 2026PublishPress Capabilities Privilege escalationCVE-2026-48197Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.
- 8.1HighSep 23, 2026PublishPress Capabilities CSRFCVE-2026-94487Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.
- 5.4MediumSep 17, 2026PublishPress Series CSRFCVE-2026-74005Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.
- 7.6HighSep 17, 2026PublishPress Series SQL injectionCVE-2026-66630Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.
- 6.5MediumSep 17, 2026PublishPress Series XSSCVE-2026-66617Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.
- 5.4MediumSep 15, 2026Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors XSSCVE-2026-85657The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profile_fields_user_email_value_prefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on a l
- 7.2HighSep 9, 2026User Role Editor – PublishPress Capabilities: Access Control and User Roles Privilege escalationCVE-2026-75927The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities — including `manage_capabilities`, `manage_capabilities_roles`, `manage_capabilities_settings`, and `manage_capabilities_backup` — via a hard-coded `$eligi
Top products
- PublishPress Series3 CVEs in the last year
- PublishPress Capabilities2 CVEs in the last year
- Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors2 CVEs in the last year
- User Role Editor – PublishPress Capabilities: Access Control and User Roles1 CVE in the last year
- PublishPress Authors1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.