Login Request a demo
PU
Vendor
PublishPress
14 products with CVEs on record
35
CVEs
0
On KEV
3
New 30D
Products
PA
PublishPress Authors
PublishPress
7.6
5 CVEs0 on KEV1 new
PS
PublishPress Series
PublishPress
7.6
5 CVEs0 on KEV1 new
PC
PublishPress Capabilities
PublishPress
8.1
4 CVEs0 on KEV1 new
SP
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
publishpress
5.5
4 CVEs0 on KEV0 new
PE
Post Expirator
PublishPress
6.5
3 CVEs0 on KEV0 new
CA
Capabilities
Publishpress
9.8
2 CVEs0 on KEV0 new
CM
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
publishpress
8.8
2 CVEs0 on KEV0 new
GB
Gutenberg Blocks
PublishPress
7.5
2 CVEs0 on KEV0 new
PR
PublishPress Revisions
PublishPress
9.3
2 CVEs0 on KEV0 new
PR
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
publishpress
6.1
2 CVEs0 on KEV0 new
AU
Authors
Publishpress
8.8
1 CVEs0 on KEV0 new
PB
PublishPress Blocks – Block Controls, Block Visibility, Block Permissions
publishpress
6.4
1 CVEs0 on KEV0 new
PP
PublishPress Permissions
PublishPress
5.3
1 CVEs0 on KEV0 new
UR
User Role Editor – PublishPress Capabilities: Access Control and User Roles
publishpress
7.2
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-115610
New
PA
PublishPress Authors
PublishPress
6.5–Oct 29WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-48197
PC
PublishPress Capabilities
PublishPress
7.2
0%
Oct 6WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
CVE-2026-39444
PS
PublishPress Series
PublishPress
5.4
0%
Oct 2WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability
CVE-2026-94487
PC
PublishPress Capabilities
PublishPress
8.1
0%
Sep 23WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2026-74005
PS
PublishPress Series
PublishPress
5.4
0%
Sep 17WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2026-66630
PS
PublishPress Series
PublishPress
7.6
0%
Sep 17WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability
CVE-2026-66617
PS
PublishPress Series
PublishPress
6.5
0%
Sep 17WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
CVE-2026-85657
CM
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
publishpress
5.4
0%
Sep 15Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter
CVE-2026-75927
UR
User Role Editor – PublishPress Capabilities: Access Control and User Roles
publishpress
7.2
1%
Sep 9PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant
CVE-2026-84771
PP
PublishPress Permissions
PublishPress
5.3
0%
Sep 2WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability
CVE-2026-27365
PS
PublishPress Series
PublishPress
5.9
0%
Aug 18WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-28183
PC
PublishPress Capabilities
PublishPress
7.2
0%
Aug 6WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
CVE-2026-5247
SP
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
publishpress
5.5
0%
May 5Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute
CVE-2026-39482
PE
Post Expirator
PublishPress
6.5
0%
Apr 8WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability
CVE-2026-32539
PR
PublishPress Revisions
PublishPress
9.3
0%
Mar 25WordPress PublishPress Revisions plugin <= 3.7.23 - SQL Injection vulnerability
CVE-2026-25309
PA
PublishPress Authors
PublishPress
7.5
0%
Mar 25WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability
CVE-2026-32394
PC
PublishPress Capabilities
PublishPress
4.3
0%
Mar 13WordPress PublishPress Capabilities plugin <= 2.31.0 - Broken Access Control vulnerability
CVE-2026-25330
PA
PublishPress Authors
PublishPress
4.3
0%
Feb 19WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability
CVE-2026-25322
PR
PublishPress Revisions
PublishPress
5.4
0%
Feb 19WordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2025-14718
SP
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
publishpress
5.4
0%
Jan 9Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation
CVE-2025-69361
PE
Post Expirator
PublishPress
4.3
0%
Jan 6WordPress Post Expirator plugin <= 4.9.3 - Broken Access Control vulnerability
CVE-2025-13741
SP
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
publishpress
4.3
0%
Dec 16Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) Authors' Emails Exposure
CVE-2025-13149
SP
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
publishpress
4.3
0%
Nov 21Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification
CVE-2025-8588
PB
PublishPress Blocks – Block Controls, Block Visibility, Block Permissions
publishpress
6.4
0%
Oct 25Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2025-48332
GB
Gutenberg Blocks
PublishPress
7.5
1%
Aug 14WordPress Gutenberg Blocks <= 3.3.1 - Local File Inclusion Vulnerability
CVE-2025-49032
GB
Gutenberg Blocks
PublishPress
6.5
0%
Jul 3WordPress Gutenberg Blocks plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability
CVE-2025-47496
PA
PublishPress Authors
PublishPress
7.5
1%
May 7WordPress PublishPress Authors plugin <= 4.7.5 - Local File Inclusion Vulnerability
CVE-2025-26886
PA
PublishPress Authors
PublishPress
7.6
0%
Mar 15WordPress PublishPress Authors plugin <= 4.7.3 - SQL Injection vulnerability
CVE-2024-11154
PR
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
publishpress
4.3
0%
Nov 20PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
CVE-2024-9215
CM
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
publishpress
8.8
1%
Oct 17Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover
CVE-2024-9436
PR
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
publishpress
6.1
0%
Oct 11PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.14 - Reflected Cross-Site Scripting
CVE-2022-3366
CA
Capabilities
Publishpress
7.2
1%
Oct 31PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection
CVE-2021-25032
CA
Capabilities
Publishpress
9.8
7%
Jan 10The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating…
CVE-2021-24783
PE
Post Expirator
Publishpress
6.5
1%
Nov 8The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of…