# CVE-2026-39482: PublishPress Post Expirator DOM-based XSS

Source: https://junglewise.ai/threats/cve-2026-39482-publishpress-post-expirator-dom-based-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39482 · Severity: medium · CVSS 6.5 · Published 2026-04-08

PublishPress Post Expirator is a WordPress plugin used to automate the expiration and deletion of posts. A security vulnerability in this plugin could allow an attacker with basic contributor access to inject malicious scripts into the website. If a site administrator or visitor views the affected content, the script could execute, potentially leading to unauthorized redirects, the display of fraudulent advertisements, or the theft of session information.

Vendors: [PublishPress](https://junglewise.ai/threats/vendors/publishpress).

## Quick answers

**Is CVE-2026-39482 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39482 being exploited in the wild.

**How severe is CVE-2026-39482?** Medium severity, with a CVSS score of 6.5, published 8 April 2026.

**Which products and versions are affected?** PublishPress Post Expirator <= 4.9.4.

**Is there a fix for CVE-2026-39482?** A patch was published on 2026-03-22: Patch released in version 4.10.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39482 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-39482?** Check whether you run PublishPress Future. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the PublishPress Post Expirator plugin (also known as post-expirator) due to improper neutralization of input during web page generation. The flaw allows an authenticated attacker with 'Contributor' level permissions or higher to inject malicious JavaScript into the Document Object Model (DOM). Successful exploitation requires a victim (such as an administrator) to interact with a specific page or link. This can lead to the execution of arbitrary code in the context of the victim's browser session, potentially allowing for session hijacking or site defacement. The issue is resolved in version 4.10.0.

## Affected products

- PublishPress Post Expirator <= 4.9.4

## Timeline

- 2026-02-20: other: Vulnerability reported by researcher timomangcut
- 2026-03-22: patched: Patch released in version 4.10.0
- 2026-04-08: disclosed: CVE published to NVD

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/post-expirator/vulnerability/wordpress-post-expirator-plugin-4-9-4-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/post-expirator/vulnerability/wordpress-post-expirator-plugin-4-9-4-cross-site-scripting-xss-vulnerability?_s_id=cve)