Log in Start free

PublishPress

Products

ProductCVEsExploitedLatest
PublishPress Series5–Oct 2, 2026
PublishPress Authors5–Oct 29, 2026
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories4–May 5, 2026
PublishPress Capabilities4–Oct 6, 2026
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors3–Oct 31, 2026
PublishPress Revisions3–Nov 6, 2026
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes2–Nov 20, 2024
Gutenberg Blocks2–Aug 14, 2025
Post Expirator2–Apr 8, 2026
User Role Editor – PublishPress Capabilities: Access Control and User Roles1–Sep 9, 2026
PublishPress Blocks – Block Controls, Block Visibility, Block Permissions1–Oct 25, 2025
PublishPress Permissions1–Sep 2, 2026

Exploited and recent CVEs

  • CVE-2026-120851 Medium 4.3 WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability –
  • CVE-2026-111592 Medium 6.4 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name 0.2%
  • CVE-2026-115610 Medium 6.5 WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-48197 High 7.2 WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability 0.4%
  • CVE-2026-39444 Medium 5.4 WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability 0.2%
  • CVE-2026-94487 High 8.1 WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2026-74005 Medium 5.4 WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2026-66630 High 7.6 WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability 0.4%
  • CVE-2026-66617 Medium 6.5 WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-85657 Medium 5.4 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter 0.2%
  • CVE-2026-75927 High 7.2 PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant 0.6%
  • CVE-2026-84771 Medium 5.3 WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability 0.3%
  • CVE-2026-27365 Medium 5.9 WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-28183 High 7.2 WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability 0.5%
  • CVE-2026-5247 Medium 5.5 Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute 0.3%
  • CVE-2026-39482 Medium 6.5 WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-32539 Critical 9.3 WordPress PublishPress Revisions plugin <= 3.7.23 - SQL Injection vulnerability 0.3%
  • CVE-2026-25309 High 7.5 WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability 0.3%
  • CVE-2026-32394 Medium 4.3 WordPress PublishPress Capabilities plugin <= 2.31.0 - Broken Access Control vulnerability 0.2%
  • CVE-2026-25330 Medium 4.3 WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability 0.2%
  • CVE-2026-25322 Medium 5.4 WordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2025-14718 Medium 5.4 Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation 0.3%
  • CVE-2025-69361 Medium 4.3 WordPress Post Expirator plugin <= 4.9.3 - Broken Access Control vulnerability 0.2%
  • CVE-2025-13741 Medium 4.3 Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) Authors' Emails Exposure 0.3%
  • CVE-2025-13149 Medium 4.3 Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification 0.2%
  • CVE-2025-8588 Medium 6.4 Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
  • CVE-2025-48332 High 7.5 WordPress Gutenberg Blocks <= 3.3.1 - Local File Inclusion Vulnerability 0.6%
  • CVE-2025-49032 Medium 6.5 WordPress Gutenberg Blocks plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2025-47496 High 7.5 WordPress PublishPress Authors plugin <= 4.7.5 - Local File Inclusion Vulnerability 0.8%
  • CVE-2025-26886 High 7.6 WordPress PublishPress Authors plugin <= 4.7.3 - SQL Injection vulnerability 0.4%