Is CVE-2026-111592 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111592 being exploited in the wild.

How severe is CVE-2026-111592?

Medium severity, with a CVSS score of 6.4, published 31 October 2026.

Which products and versions are affected?

PublishPress Authors up to and including 4.17.0.

Is there a fix for CVE-2026-111592?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111592 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111592?

Check whether you run PublishPress Authors at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111592: PublishPress Authors stored XSS in author display name

CVE-2026-111592 · Severity: medium · CVSS 6.4 · Published 2026-10-31

PublishPress Authors is a WordPress plugin that manages multiple author attribution on content. The plugin fails to properly sanitize the author display name field, allowing authenticated users with subscriber or higher privileges to inject malicious scripts that execute for all visitors viewing affected pages. An attacker must first be assigned as a co-author by an administrator or have automatic co-author creation enabled for their role.

Technologies: PublishPress Authors. Vendors: PublishPress.

Quick answers

Is CVE-2026-111592 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111592 being exploited in the wild.
How severe is CVE-2026-111592?: Medium severity, with a CVSS score of 6.4, published 31 October 2026.
Which products and versions are affected?: PublishPress Authors up to and including 4.17.0.
Is there a fix for CVE-2026-111592?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111592 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111592?: Check whether you run PublishPress Authors at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin contains a stored cross-site scripting (XSS) vulnerability in the display_name (author name) parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can inject arbitrary JavaScript via their author profile's display name field if they have a mapped author term, which requires prior administrative assignment or role-based auto-mapping. The injected scripts persist in the database and execute in the browsers of all users viewing pages where that author is displayed.

Affected products

PublishPress PublishPress Authors up to and including 4.17.0

Timeline

2026-10-31: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.