SecAlerts
p

publishpress

Security Risk Profile

47
/100
medium

Security Risk Score

Comprehensive risk assessment based on 22 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from November 8, 2021 to present

22
Total CVEs
10
Critical+High
0
Exploited
6
Unpatched

Threat Assessment

Avg CVSS
6.7
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
6
Critical/High
Risk Level
47/100
medium
🆕 1Fresh (<7d)📈 5 in Last 30 Days

Severity Distribution

Critical
1
High
9
Medium
11
Low
0

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
5

Age Distribution

Common Weaknesses (CWE)

1
XSS
7
2
CSRF
2
3
SQL Injection
1

Most Affected Products

1. PublishPress PublishPress Capabilities4
2. PublishPress Capabilities WordPress4
3. PublishPress PublishPress Series2
4. PublishPress Gutenberg Blocks2
5. PublishPress PublishPress Authors2

Recent Vulnerabilities

See more →
CVE-2026-105261
unknown

PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes

Oct 14, 2026🔧 No Patch
CVE-2026-48197
CVSS 7.2high

WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Oct 6, 2026🔧 No Patch
CVE-2026-39444
CVSS 5.4medium

WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability

Oct 2, 2026🔧 No Patch
CVE-2026-94487
CVSS 8.1EPSS 0%high

WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

Sep 23, 2026🔧 No Patch
CVE-2026-66617
CVSS 6.5medium

WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

Sep 17, 2026🔧 No Patch
CVE-2026-75927
CVSS 7.2high

PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

Sep 9, 2026🔧 No Patch
CVE-2026-84771
CVSS 5.3medium

WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability

Sep 2, 2026🔧 No Patch
CVE-2026-28183
CVSS 7.2high

WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Aug 6, 2026🔧 No Patch
CVE-2026-5247
CVSS 5.5medium

Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute

May 5, 2026🔧 No Patch
CVE-2026-39482
CVSS 6.5medium

WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability

Apr 8, 2026🔧 No Patch

Monitor publishpress in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.