Read the docs

PublishPress

Records36All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

PublishPress records in CISA KEV

No PublishPress vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Capabilities 2 records HIGH Post Expirator 1 record LOW

Records

2 records in Capabilities · all components

TI-2022-03111 CVE-2022-3366 · GHSA-x27x-7595-v3m5

PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection

Priority HIGH 67

The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by adm…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01485 Published 2022-10-31 Fixed in 2.5.2 CWE-502
TI-2021-07310 CVE-2021-25032 · GHSA-jvmr-8pwj-ffqf

PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise

Priority MEDIUM 52

The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook,…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07069 Published 2022-01-10 Fixed in 2.3.1 CWE-352
Open these records in search →