Live › vulnerability › CVE-2026-115610
The PublishPress Authors plugin for WordPress does not neutralize input before generating web pages, which allows stored cross-site scripting. An attacker who can supply content that gets saved and shown to others can run scripts in other users' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the PublishPress Authors WordPress plugin at version 4.17.0 or earlier. The sources do not say which roles can submit the stored input, so unknown whether only logged-in authors or any visitor can trigger it.
No product ranges from the sources yet.
publishpress-authors) is installed on the WordPress site4.17.0No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115610")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.