Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-07
PublishPress Revisions - Security Vulnerability (CVE-2026-120851)
Missing Authorization vulnerability in PublishPress PublishPress Revisions revisionary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Revisions: from n/a through 4.2.0.
PLUGIN
PublishPress Revisions
CVE-2026-120851
Risk Score
Threat Entry
Updated 2026-11-06
PublishPress Revisions - Security Vulnerability (CVE-2026-118188)
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowing any authenticated user, including a Subscriber, to read the title, content and excerpt of any other user's private, draft, pending, scheduled or trashed post.
PLUGIN
PublishPress Revisions
CVE-2026-118188
Risk Score
Threat Entry
Updated 2026-11-06
PublishPress Revisions - Security Vulnerability (CVE-2026-118186)
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing the intended editorial approval workflow.
PLUGIN
PublishPress Revisions
CVE-2026-118186
Risk Score
Threat Entry
Updated 2026-11-06
PublishPress Revisions - Security Vulnerability (CVE-2026-118187)
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.
PLUGIN
PublishPress Revisions
CVE-2026-118187
Risk Score
Threat Entry
Updated 2026-06-17
PublishPress Revisions - Information Disclosure (CVE-2024-11154)
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the 'actAjaxRevisionDiffs' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages.
PLUGIN
PublishPress Revisions
CVE-2024-11154
Risk Score
Threat Entry
Updated 2026-06-17
PublishPress Revisions - Cross-Site Scripting (XSS) (CVE-2024-9436)
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.14. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
PublishPress Revisions
CVE-2024-9436
Risk Score