CVE-2026-39482: WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Post Expirator post-expirator allows DOM-Based XSS.This issue affects Post Expirator: from n/a through <= 4.9.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39482?
CVE-2026-39482 is classified as a cross-site scripting (XSS) vulnerability, which can have a severe impact on user data and application integrity.
How do I fix CVE-2026-39482?
To fix CVE-2026-39482, update the PublishPress Post Expirator plugin to a version later than 4.9.4.
Which versions of the PublishPress Post Expirator are affected by CVE-2026-39482?
CVE-2026-39482 affects all versions of the PublishPress Post Expirator plugin up to and including 4.9.4.
What type of attack can CVE-2026-39482 facilitate?
CVE-2026-39482 can facilitate DOM-based Cross-site Scripting (XSS) attacks, allowing attackers to execute scripts in the context of another user’s session.
Is CVE-2026-39482 specific to WordPress?
Yes, CVE-2026-39482 is specific to the WordPress Post Expirator plugin.