Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-02
Publishpress Authors - Security Vulnerability (CVE-2026-111592)
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (maps to display_name)' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker's user account to have a mapped author term, which occurs when…
PLUGIN
Publishpress Authors
CVE-2026-111592
Risk Score
Threat Entry
Updated 2026-10-30
Publishpress Authors - Security Vulnerability (CVE-2026-115610)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.
PLUGIN
Publishpress Authors
CVE-2026-115610
Risk Score
Threat Entry
Updated 2026-06-17
Publishpress Authors - Broken Access Control (CVE-2026-25309)
Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Authors: from n/a through
PLUGIN
Publishpress Authors
CVE-2026-25309
Risk Score
Threat Entry
Updated 2026-06-17
Publishpress Authors - Broken Access Control (CVE-2026-25330)
Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Authors: from n/a through
PLUGIN
Publishpress Authors
CVE-2026-25330
Risk Score
Threat Entry
Updated 2026-06-17
Publishpress Authors - Path Traversal (CVE-2025-47496)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PublishPress PublishPress Authors publishpress-authors allows PHP Local File Inclusion.This issue affects PublishPress Authors: from n/a through
PLUGIN
Publishpress Authors
CVE-2025-47496
Risk Score
Threat Entry
Updated 2026-06-17
Publishpress Authors - SQL Injection (CVE-2025-26886)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Authors publishpress-authors allows SQL Injection.This issue affects PublishPress Authors: from n/a through
PLUGIN
Publishpress Authors
CVE-2025-26886
Risk Score
Threat Entry
Updated 2026-06-17
Publishpress Authors - Privilege Escalation (CVE-2024-9215)
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Insecure Direct Object Reference to Privilege Escalation/Account Takeover in all versions up to, and including, 4.7.1 via the action_edited_author() due to missing validation on the 'authors-user_id' user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to update arbitrary user accounts email addresses, including administrators, which can then be leveraged to reset that user's account password and gain access.
PLUGIN
Publishpress Authors
CVE-2024-9215
Risk Score