SecAlerts
publishpress logo

publishpress

Security Risk Profile

51
/100
medium

Security Risk Score

Comprehensive risk assessment based on 15 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from November 8, 2021 to present

15
Total CVEs
7
Critical+High
0
Exploited
3
Unpatched

Threat Assessment

Avg CVSS
6.8
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
3
Critical/High
Risk Level
51/100
medium
🆕 1Fresh (<7d)📈 1 in Last 30 Days

Severity Distribution

Critical
1
High
6
Medium
8
Low
0

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
4

Age Distribution

Common Weaknesses (CWE)

1
XSS
5
2
SQL Injection
1
3
CSRF
1

Most Affected Products

1. PublishPress Capabilities WordPress4
2. PublishPress Gutenberg Blocks2
3. PublishPress PublishPress Authors2
4. PublishPress Capabilities1
5. PublishPress Schedule Post Changes With PublishPress Future1

Recent Vulnerabilities

See more →
CVE-2026-28183
CVSS 7.2high

WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

8/6/2026🔧 No Patch
CVE-2026-5247
CVSS 5.5medium

Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute

5/5/2026🔧 No Patch
CVE-2026-39482
CVSS 6.5medium

WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability

4/8/2026🔧 No Patch
CVE-2025-13149
CVSS 4.3medium

Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification

11/21/2025🔧 No Patch
CVE-2025-8588
CVSS 6.4medium

Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

10/25/2025🔧 No Patch
CVE-2025-48332
CVSS 7.5high

WordPress Gutenberg Blocks <= 3.3.1 - Local File Inclusion Vulnerability

8/14/2025
CVE-2025-49032
CVSS 6.5medium

WordPress Gutenberg Blocks plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability

7/3/2025
CVE-2025-47496
CVSS 7.5EPSS 0%high

WordPress PublishPress Authors plugin <= 4.7.5 - Local File Inclusion Vulnerability

5/7/2025
CVE-2025-26886
CVSS 7.6EPSS 0%high

WordPress PublishPress Authors plugin <= 4.7.3 - SQL Injection vulnerability

3/15/2025
CVE-2024-11154
CVSS 4.3medium

PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure

11/20/2024🔧 No Patch

Monitor publishpress in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.