CVE-2026-115610: WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/publishpress-authorsto a version that resolves this vulnerability.Fixed in 4.18.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-privileged access to the affected WordPress site and must induce a user to interact with the malicious content. The vector is network-accessible, and the vulnerability can affect confidentiality, integrity, and availability beyond the vulnerable component.
Which plugin versions are affected?
PublishPress Authors versions through 4.17.0 are affected. The available data does not identify a fixed version.
Is this a stored or reflected XSS issue?
This is a stored XSS vulnerability. Malicious input can be retained by the application and later rendered in a web page without proper neutralization.