Is CVE-2026-85657 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85657 being exploited in the wild.

How severe is CVE-2026-85657?

Medium severity, with a CVSS score of 5.4, published 15 September 2026.

Which products and versions are affected?

PublishPress Authors up to and including 4.15.0.

Is there a fix for CVE-2026-85657?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85657 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85657?

Check whether you run PublishPress Authors at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85657: PublishPress Authors stored cross-site scripting in author box

CVE-2026-85657 · Severity: medium · CVSS 5.4 · Published 2026-09-15

PublishPress Authors is a WordPress plugin that manages co-authors and guest authors in content. The plugin fails to properly sanitize user input in author profile fields, allowing authenticated users with Author-level permissions to inject malicious scripts. When site visitors click links or interact with affected pages, these scripts execute in their browsers, potentially compromising user sessions or data.

Technologies: PublishPress Authors. Vendors: PublishPress.

Quick answers

Is CVE-2026-85657 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85657 being exploited in the wild.
How severe is CVE-2026-85657?: Medium severity, with a CVSS score of 5.4, published 15 September 2026.
Which products and versions are affected?: PublishPress Authors up to and including 4.15.0.
Is there a fix for CVE-2026-85657?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85657 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85657?: Check whether you run PublishPress Authors at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin contains a stored cross-site scripting (XSS) vulnerability in the 'profile_fields_user_email_value_prefix' parameter due to insufficient input sanitization and output escaping in the author-boxes module. The vulnerability requires authentication (Author-level access or above) and allows an attacker to inject arbitrary JavaScript that persists in the database and executes in the browsers of all users who view the affected content. The vulnerability affects all versions up to and including 4.15.0. A patch is assumed to be available in a version after 4.15.0.

Affected products

PublishPress Authors up to and including 4.15.0

Timeline

2026-09-15: disclosed: CVE-2026-85657 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.