CVE-2026-27365: WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS.
This issue affects PublishPress Series: from n/a through 2.17.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress PublishPress Series pluginto a version that resolves this vulnerability.Fixed in 2.17.1
Event History
Frequently Asked Questions
Which plugin versions are affected?
The affected range includes PublishPress Series versions through 2.17.0; no lower bound is specified. The vulnerability is a stored XSS issue in the WordPress plugin.
What access and conditions are required for exploitation?
The supplied vector indicates the attack can be performed over the network with low attack complexity, but requires high privileges and user interaction. Successful exploitation can affect confidentiality, integrity, and availability beyond the vulnerable component’s security scope.