CVEs we hold for Publishpress
Records whose assigning authority named Publishpress as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-85657Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated…PublishPress Authors
CVE-2026-84771WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerabilityPublishPress Permissions
CVE-2026-75927PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability…PublishPress Capabilities: Access Control and User Roles
CVE-2026-74005WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerabilityPublishPress Series
CVE-2026-66630WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerabilityPublishPress Series
CVE-2026-66617WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilityPublishPress Series
CVE-2026-5247Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 -…PublishPress Future: Unpublish, Delete, Change Status…
CVE-2026-39482WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerabilityPublishPress Post Expirator
CVE-2026-32539WordPress PublishPress Revisions plugin <= 3.7.23 - SQL Injection vulnerabilityPublishPress Revisions
CVE-2026-32394WordPress PublishPress Capabilities plugin <= 2.31.0 - Broken Access Control vulnerabilityPublishPress Capabilities
CVE-2026-27365WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerabilityPublishPress Series
CVE-2026-25330WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerabilityPublishPress Authors
CVE-2026-25322WordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerabilityPublishPress Revisions
CVE-2026-25309WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerabilityPublishPress Authors
CVE-2025-8588Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.3.4 - Authenticated (Contributor+)…PublishPress Blocks – Block Controls, Block Visibility…
CVE-2025-69361WordPress Post Expirator plugin <= 4.9.3 - Broken Access Control vulnerabilityPublishPress Post Expirator
CVE-2025-49032WordPress Gutenberg Blocks plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerabilityPublishPress Gutenberg Blocks
CVE-2025-48332WordPress Gutenberg Blocks <= 3.3.1 - Local File Inclusion VulnerabilityPublishPress Gutenberg Blocks
CVE-2025-47496WordPress PublishPress Authors plugin <= 4.7.5 - Local File Inclusion VulnerabilityPublishPress Authors
CVE-2025-26886WordPress PublishPress Authors plugin <= 4.7.3 - SQL Injection vulnerabilityPublishPress Authors
CVE-2025-14718Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 -…PublishPress Future: Unpublish, Delete, Change Status…
CVE-2025-13741Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.2 -…PublishPress Future: Unpublish, Delete, Change Status…
CVE-2025-13149Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 -…PublishPress Future: Unpublish, Delete, Change Status…
CVE-2024-9436PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.14 - Reflected Cross-Site…PublishPress Revisions: Duplicate Posts, Submit, Approve…
CVE-2024-9215Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct…PublishPress Authors
CVE-2024-11154PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization…PublishPress Revisions: Duplicate Posts, Submit, Approve…
CVE-2022-3366PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection InjectionUnknown PublishPress Capabilities Pro
CVE-2021-25032PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog CompromiseUnknown PublishPress Capabilities Pro
28 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.