Executive brief
PublishPress Authors is a WordPress plugin that manages co-authors and guest authors in content. The plugin fails to properly sanitize user input in author profile fields, allowing authenticated users with Author-level permissions to inject malicious scripts. When site visitors click links or interact with affected pages, these scripts execute in their browsers, potentially compromising user sessions or data.
Technical details
The plugin contains a stored cross-site scripting (XSS) vulnerability in the 'profile_fields_user_email_value_prefix' parameter due to insufficient input sanitization and output escaping in the author-boxes module. The vulnerability requires authentication (Author-level access or above) and allows an attacker to inject arbitrary JavaScript that persists in the database and executes in the browsers of all users who view the affected content. The vulnerability affects all versions up to and including 4.15.0. A patch is assumed to be available in a version after 4.15.0.
Affected products
- PublishPress Authors up to and including 4.15.0
Timeline
- 2026-09-15: disclosed: CVE-2026-85657 published