Publishpress
31 CVEs across 14 Publishpress products. Browse Publishpress vulnerabilities, severities, and proof-of-concept exploits.
Publishpress products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-94487 | High | 8.1 | 2026-09-23 | Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions. |
CVE-2026-74005 | Medium | 5.4 | 2026-09-17 | Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions. |
CVE-2026-66630 | High | 7.6 | 2026-09-17 | Administrator SQL Injection in PublishPress Series <= 3.1.3 versions. |
CVE-2026-66617 | Medium | 6.5 | 2026-09-17 | Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions. |
CVE-2026-85657 | Medium | 5.4 | 2026-09-15 | The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-75927 | High | 7.2 | 2026-09-09 | The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation… |
CVE-2026-84771 | Medium | 5.3 | 2026-09-02 | Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions. |
CVE-2026-27365 | Medium | 5.9 | 2026-08-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This… |
CVE-2026-28183 | High | 7.2 | 2026-08-06 | Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affec… |
CVE-2026-5247 | Medium | 5.5 | 2026-05-05 | The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper' attribute of the [future… |
CVE-2026-39482 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Post Expirator post-expirator allows DOM-Bas… |
CVE-2026-32539 | Critical | 9.3 | 2026-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Revisions revisionary allows Bl… |
CVE-2026-25309 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-32394 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-25330 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-25322 | Medium | 5.4 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in PublishPress PublishPress Revisions revisionary allows Cross Site Request Forgery.This issue affects Publish… |
CVE-2025-14718 | Medium | 5.4 | 2026-01-09 | The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This… |
CVE-2025-69361 | Medium | 4.3 | 2026-01-06 | Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-13741 | Medium | 4.3 | 2025-12-16 | The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthoriz… |
CVE-2025-13149 | Medium | 4.3 | 2025-11-21 | The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthoriz… |
CVE-2025-8588 | Medium | 6.4 | 2025-10-25 | The Gutenberg Blocks – PublishPress Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Marker Title' and 'Marker Description' pa… |
CVE-2025-48332 | High | 7.5 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PublishPress Gutenberg Blocks advanced… |
CVE-2025-49032 | Medium | 6.5 | 2025-07-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows S… |
CVE-2025-47496 | High | 7.5 | 2025-05-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PublishPress PublishPress Authors publ… |
CVE-2025-26886 | High | 7.6 | 2025-03-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Authors publishpress-authors al… |
CVE-2024-11154 | Medium | 4.3 | 2024-11-20 | The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure… |
CVE-2024-9215 | High | 8.8 | 2024-10-17 | The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Insecure Direct Object Refe… |
CVE-2024-9436 | Medium | 6.1 | 2024-10-11 | The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting… |
CVE-2022-3366 | High | 7.2 | 2022-10-31 | The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported f… |
CVE-2021-25032 | Critical | 9.8 | 2022-01-10 | The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF c… |
CVE-2021-24783 | Medium | 6.5 | 2021-11-08 | The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to… |