CVE-2026-105261: PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with the Contributor role or higher can store the malicious shortcode attributes. Exploitation requires a higher-privileged user to view the affected content.
Which plugin versions are affected?
PublishPress Future versions 4.10.1 through 4.10.5 are affected. The issue is fixed in version 4.10.6.
What input is involved in the attack?
The vulnerable shortcode attributes are "wrapper" and "dateformat." The plugin does not safely restrict the HTML element selected by the wrapper attribute or neutralize attacker-controlled text placed within the resulting element.