# PublishPress vulnerabilities Source: https://junglewise.ai/threats/vendors/publishpress Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/publishpress.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 16 vulnerabilities in PublishPress: 4 in the last 7 days and 15 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-120851, was published on 6 November 2026. 6 vulnerabilities in the last four weeks, down 14% on the four before (7). 3 technologies have a page of their own. ## Counts - Last 7 days: 4 - Last 30 days: 6 - Last 90 days: 15 - All time: 16 (0 critical, 0 exploited in the wild) ## About PublishPress A developer of WordPress plugins for editorial management and content scheduling. ## Latest PublishPress vulnerabilities - [CVE-2026-120851: PublishPress Revisions broken access control in revisionary](https://junglewise.ai/threats/cve-2026-120851-missing-authorization-vulnerability-in-publishpress-publishpress) (medium, CVSS 4.3, published 6 Nov 2026) - [CVE-2026-118188: PublishPress Revisions information disclosure via revision-comparison](https://junglewise.ai/threats/cve-2026-118188-the-publishpress-revisions-duplicate-posts-submit-approve-and) (info, published 6 Nov 2026) - [CVE-2026-118187: PublishPress Revisions Insecure Direct Object Reference in content duplication](https://junglewise.ai/threats/cve-2026-118187-the-publishpress-revisions-duplicate-posts-submit-approve-and) (info, published 6 Nov 2026) - [CVE-2026-118186: PublishPress Revisions authorization bypass in content publishing](https://junglewise.ai/threats/cve-2026-118186-the-publishpress-revisions-duplicate-posts-submit-approve-and) (info, published 6 Nov 2026) - [CVE-2026-111592: PublishPress Authors stored XSS in author display name](https://junglewise.ai/threats/cve-2026-111592-the-co-authors-multiple-authors-and-guest-authors-in-an-author) (medium, CVSS 6.4, published 31 Oct 2026) - [CVE-2026-115610: PublishPress Authors stored cross-site scripting](https://junglewise.ai/threats/cve-2026-115610-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-48197: PublishPress Capabilities privilege escalation in capability-manager-enhanced](https://junglewise.ai/threats/cve-2026-48197-incorrect-privilege-assignment-vulnerability-in-publishpress) (high, CVSS 7.2, published 6 Oct 2026) - [CVE-2026-39444: PublishPress Series insecure direct object reference in organize-series](https://junglewise.ai/threats/cve-2026-39444-authorization-bypass-through-user-controlled-key-vulnerability-in) (medium, CVSS 5.4, published 2 Oct 2026) - [CVE-2026-94487: PublishPress Capabilities cross-site request forgery](https://junglewise.ai/threats/cve-2026-94487-unauthenticated-cross-site-request-forgery-csrf-in-publishpress) (high, CVSS 8.1, published 23 Sep 2026) - [CVE-2026-74005: PublishPress Series unauthenticated cross-site request forgery](https://junglewise.ai/threats/cve-2026-74005-publishpress-series-unauthenticated-cross-site-request-forgery) (medium, CVSS 5.4, published 17 Sep 2026) - [CVE-2026-66630: PublishPress Series SQL Injection in administrator panel](https://junglewise.ai/threats/cve-2026-66630-publishpress-series-sql-injection-in-administrator-panel) (high, CVSS 7.6, published 17 Sep 2026) - [CVE-2026-66617: PublishPress Series Cross-Site Scripting (XSS) in plugin](https://junglewise.ai/threats/cve-2026-66617-publishpress-series-cross-site-scripting-xss-in-plugin) (medium, CVSS 6.5, published 17 Sep 2026) - [CVE-2026-85657: PublishPress Authors stored cross-site scripting in author box](https://junglewise.ai/threats/cve-2026-85657-publishpress-authors-stored-cross-site-scripting-in-author-box) (medium, CVSS 5.4, published 15 Sep 2026) - [CVE-2026-75927: PublishPress Capabilities privilege escalation](https://junglewise.ai/threats/cve-2026-75927-publishpress-capabilities-privilege-escalation) (high, CVSS 7.2, published 9 Sep 2026) - [CVE-2026-84771: PublishPress Permissions IDOR in object reference handling](https://junglewise.ai/threats/cve-2026-84771-publishpress-permissions-idor-in-object-reference-handling) (medium, CVSS 5.3, published 2 Sep 2026) - [CVE-2026-39482: PublishPress Post Expirator DOM-based XSS](https://junglewise.ai/threats/cve-2026-39482-publishpress-post-expirator-dom-based-xss) (medium, CVSS 6.5, published 8 Apr 2026) ## Most severe PublishPress vulnerabilities - [CVE-2026-94487: PublishPress Capabilities cross-site request forgery](https://junglewise.ai/threats/cve-2026-94487-unauthenticated-cross-site-request-forgery-csrf-in-publishpress) (high, CVSS 8.1, published 23 Sep 2026) - [CVE-2026-66630: PublishPress Series SQL Injection in administrator panel](https://junglewise.ai/threats/cve-2026-66630-publishpress-series-sql-injection-in-administrator-panel) (high, CVSS 7.6, published 17 Sep 2026) - [CVE-2026-75927: PublishPress Capabilities privilege escalation](https://junglewise.ai/threats/cve-2026-75927-publishpress-capabilities-privilege-escalation) (high, CVSS 7.2, published 9 Sep 2026) - [CVE-2026-48197: PublishPress Capabilities privilege escalation in capability-manager-enhanced](https://junglewise.ai/threats/cve-2026-48197-incorrect-privilege-assignment-vulnerability-in-publishpress) (high, CVSS 7.2, published 6 Oct 2026) - [CVE-2026-66617: PublishPress Series Cross-Site Scripting (XSS) in plugin](https://junglewise.ai/threats/cve-2026-66617-publishpress-series-cross-site-scripting-xss-in-plugin) (medium, CVSS 6.5, published 17 Sep 2026) - [CVE-2026-39482: PublishPress Post Expirator DOM-based XSS](https://junglewise.ai/threats/cve-2026-39482-publishpress-post-expirator-dom-based-xss) (medium, CVSS 6.5, published 8 Apr 2026) - [CVE-2026-115610: PublishPress Authors stored cross-site scripting](https://junglewise.ai/threats/cve-2026-115610-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-111592: PublishPress Authors stored XSS in author display name](https://junglewise.ai/threats/cve-2026-111592-the-co-authors-multiple-authors-and-guest-authors-in-an-author) (medium, CVSS 6.4, published 31 Oct 2026) - [CVE-2026-85657: PublishPress Authors stored cross-site scripting in author box](https://junglewise.ai/threats/cve-2026-85657-publishpress-authors-stored-cross-site-scripting-in-author-box) (medium, CVSS 5.4, published 15 Sep 2026) - [CVE-2026-39444: PublishPress Series insecure direct object reference in organize-series](https://junglewise.ai/threats/cve-2026-39444-authorization-bypass-through-user-controlled-key-vulnerability-in) (medium, CVSS 5.4, published 2 Oct 2026) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, down 14% on the four before (7). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 4 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 4 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## PublishPress technologies - [PublishPress Revisions](https://junglewise.ai/threats/technologies/revisions): 4 vulnerabilities - [PublishPress Series](https://junglewise.ai/threats/technologies/series): 4 vulnerabilities - [PublishPress Authors](https://junglewise.ai/threats/technologies/publishpress-authors): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "PublishPress vulnerabilities", https://junglewise.ai/threats/vendors/publishpress, 9 November 2026.