SecAlerts
p

publishpress

Security Risk Profile

38
/100
low

Security Risk Score

Comprehensive risk assessment based on 30 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from November 8, 2021 to present

30
Total CVEs
10
Critical+High
0
Exploited
7
Unpatched

Threat Assessment

Avg CVSS
6.3
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
7
Critical/High
Risk Level
38/100
low
🆕 3Fresh (<7d)📈 8 in Last 30 Days

Severity Distribution

Critical
1
High
9
Medium
19
Low
1

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
5

Age Distribution

Common Weaknesses (CWE)

1
XSS
9
2
CSRF
2
3
Infoleak
1
4
SQL Injection
1

Most Affected Products

1. PublishPress Gutenberg Blocks5
2. PublishPress PublishPress Capabilities4
3. PublishPress Capabilities WordPress4
4. PublishPress Revisions3
5. PublishPress PublishPress Authors3

Recent Vulnerabilities

See more →
CVE-2026-125819
CVSS 5.3medium

WordPress Gutenberg Blocks plugin <= 3.7.6 - Broken Access Control vulnerability

Nov 13, 2026🔧 No Patch
CVE-2026-121721
CVSS 6.5medium

WordPress Gutenberg Blocks plugin <= 3.7.6 - Cross Site Scripting (XSS) vulnerability

Nov 13, 2026🔧 No Patch
CVE-2026-121771
CVSS 5.3medium

WordPress Gutenberg Blocks plugin <= 3.7.6 - Sensitive Data Exposure vulnerability

Nov 13, 2026🔧 No Patch
CVE-2026-120851
CVSS 4.3medium

WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability

Nov 6, 2026🔧 No Patch
CVE-2026-118188
CVSS 4.3medium

PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure

Nov 6, 2026🔧 No Patch
CVE-2026-118187
CVSS 2.7low

PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR

Nov 6, 2026🔧 No Patch
CVE-2026-118186
CVSS 4.9medium

PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow

Nov 6, 2026🔧 No Patch
CVE-2026-111592
CVSS 6.4medium

Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name

Oct 31, 2026🔧 No Patch
CVE-2026-105261
CVSS 6.8medium

PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes

Oct 14, 2026🔧 No Patch
CVE-2026-48197
CVSS 7.2high

WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Oct 6, 2026🔧 No Patch

Monitor publishpress in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.

publishpress Security Vulnerabilities & Risk Score | 30 CVEs | SecAlerts - SecAlerts