CVE-2026-105261

Deferred Deferred - Pending Action

Stored XSS in PublishPress Future WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105261

EUVD

EUVD-2026-100878

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Schedule	Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories 4.10.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the PublishPress Future WordPress plugin versions 4.10.1 through 4.10.5. It allows users with the Contributor role or higher to inject malicious JavaScript via the 'wrapper' and 'dateformat' shortcode attributes. The plugin fails to enforce a safe HTML-element allowlist or neutralize attacker-controlled text, causing the script to execute when higher-privileged users view the content.

Detection Guidance

Check the installed version of the PublishPress Future plugin using WordPress admin panel or via command line. Look for versions 4.10.1 through 4.10.5 which are vulnerable. Use commands like 'wp plugin list' in WP-CLI or inspect the plugin directory for version details.

Impact Analysis

Attackers with Contributor access or higher could inject malicious scripts that execute when administrators or other privileged users view posts or pages. This could lead to session hijacking, unauthorized actions, or data theft. The impact depends on the privileges of the targeted users.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face compliance penalties if user data is compromised due to this flaw.

Mitigation Strategies

Update the PublishPress Future plugin to version 4.10.6 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review user roles and permissions to limit Contributor access to trusted users only.

Hi! I’m here to help you understand CVE-2026-105261. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70