CVE-2026-85657: Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profilefieldsuseremailvalueprefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on a link.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with the Author role or a higher-privileged role. Exploitation also requires a user to click a link containing the stored script payload.
Which installations are affected?
PublishPress Authors versions through 4.15.0 are affected. The provided information does not identify any configuration prerequisite beyond using the vulnerable plugin version.
What is the impact if exploitation succeeds?
An Author-level or higher user can store arbitrary web script through the profile_fields_user_email_value_prefix parameter. The script executes in a user's browser when that user clicks the affected link, with low confidentiality and integrity impact indicated by the supplied vector.
How can I determine whether I may be exposed?
Check whether WordPress has PublishPress Authors installed and whether its version is 4.15.0 or earlier. Also review values associated with the profile_fields_user_email_value_prefix parameter and investigate unexpected links that could trigger script execution.