PublishPress Authors
PublishPress Authors assigns multiple authors to WordPress posts and displays configurable author information and author boxes.
PublishPress Authors (publishpress-authors) is a WordPress plugin with 6 published CVE records in this archive. The latest tracked vulnerability was published Sep 15, 2026; the highest published CVSS base score is 8.8.
publishpress-authorsCVE-2026-85657: PublishPress Authors lets authors store scripts in author-box email links
PublishPress Authors through 4.15.0 insufficiently sanitizes and escapes the profile_fields_user_email_value_prefix parameter. An authenticated user with the Author role or higher can supply a value that is stored and rendered in a page link; the injected script executes in the site's browser context when another user clicks that link. An administrator who clicks the affected link may also be exposed, making this a useful stored-XSS chaining primitive. The authoritative export identifies the parameter but does not disclose the write endpoint, action, handler function, or exact HTML context.
| Safe version |
|
||
|---|---|---|---|
| Sep 15, 2026 |
CVE-2026-85657
PublishPress Authors lets authors store scripts in author-box email links
PublishPress Authors through 4.15.0 insufficiently sanitizes and escapes the profile_fields_user_email_value_prefix parameter. An authenticated user with the Author role or higher can supply a value that is stored and rendered in a page link; the injected script executes in the site's browser context when another user clicks that link. An administrator who clicks the affected link may also be exposed, making this a useful stored-XSS chaining primitive. The authoritative export identifies the parameter but does not disclose the write endpoint, action, handler function, or exact HTML context.
|
See mitigation notes |
CVE5.4
|
| Mar 25, 2026 |
CVE-2026-25309
PublishPress Authors: A security weakness
PublishPress Authors is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.10.1.
|
4.11.0 |
CVE7.5
|
| Feb 19, 2026 |
CVE-2026-25330
PublishPress Authors: A security weakness
PublishPress Authors is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
|
| May 07, 2025 |
CVE-2025-47496
PublishPress Authors: Filesystem traversal
PublishPress Authors is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
|
| Mar 15, 2025 |
CVE-2025-26886
PublishPress Authors: SQL injection
PublishPress Authors is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.6
|
| Oct 17, 2024 |
CVE-2024-9215
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors: Privilege escalation or authentication bypass
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated author account. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE8.8
|