Live › vulnerability › CVE-2026-111592
The PublishPress Authors plugin for WordPress does not sanitize the author name field, so a logged-in subscriber can store a script in it. The script runs in the browser of anyone who opens a page showing that author box.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 08:34 UTC. All times on this page are UTC.
Sites running the PublishPress Authors plugin at version 4.17.0 or earlier, where a subscriber-level account has a mapped author term. The sources say this mapping is not present by default for new users on a stock install, so sites without co-author assignments or automatic author term creation for subscribers are less exposed. unknown for whether a fixed version exists.
No product ranges from the sources yet.
4.17.0 are affectedNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (maps to display_name)' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker's user account to have a mapped author term, which occurs when an administrator has assigned them as a co-author on content or has enabled automatic author term creation for their role — this mapping is not present by default for new users on a stock install.
This page as .md · .json · in your agent: get_signal("CVE-2026-111592")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.