Cross-site scripting in PublishPress Schedule Post Changes With PublishPress Future…
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper' attribute of the [futureaction] shortcode in all versions up to, and including, 4.10.0. This is due to insufficient input sanitization on the wrapper attribute. The plugin uses esc_html() to escape the value, but esc_html() only encodes HTML entities and does not prevent attribute injection when the value is used as an HTML tag name in a sprintf() call. An attacker can inject event handler attributes via spaces in the wrapper value. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Since it is also possible for administrators to make this functionality available to lower-privileged users, this introduces the possibility of abuse by contributors.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PublishPress | Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories | up to 4.10.0 | — | No fix listed | CNA |
- Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories VendorPublishPress Affected up to 4.10.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-5247
- 2026-10-03 Alias added: GHSA-p9xc-cphq-3q9h
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9acf80aa-8354-4430-9836-18fa17854521?source=cve
- https://plugins.trac.wordpress.org/browser/post-expirator/trunk/src/Modules/Expirator/Controllers/ShortcodeController.php#L173
- https://plugins.trac.wordpress.org/browser/post-expirator/tags/4.9.4/src/Modules/Expirator/Controllers/ShortcodeController.php#L173
- https://github.com/publishpress/publishpress-future/releases
More PublishPress vulnerabilities
- TI-2022-03111 PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection CVSS 3.1HIGH 7.2
- TI-2021-07310 PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise CVSS 3.1CRITICAL 9.8
- TI-2026-25067 WordPress PublishPress Revisions plugin <= 3.7.23 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
- TI-2024-08551 Authorization bypass in PublishPress Co-Authors, Multiple Authors and Guest Authors in an… CVSS 3.1HIGH 8.8
- TI-2026-20427 WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5
- TI-2025-30658 WordPress Gutenberg Blocks <= 3.3.1 - Local File Inclusion Vulnerability CVSS 3.1HIGH 7.5
Sources
- CVE-2026-5247 · CVE Program
- CVE-2026-5247 · NVD
- FIRST EPSS
- GHSA-p9xc-cphq-3q9h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences