CVE-2026-111592
Received Received - Intake

Stored XSS in PublishPress Authors WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (maps to display_name)' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker's user account to have a mapped author term, which occurs when an administrator has assigned them as a co-author on content or has enabled automatic author term creation for their role — this mapping is not present by default for new users on a stock install.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-111592
EUVD
EUVD-2026-114646

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the PublishPress Authors WordPress plugin. It allows authenticated attackers with subscriber-level access or higher to inject malicious scripts via the 'name' parameter, which maps to the display_name field. The issue arises due to insufficient input sanitization and output escaping in versions up to 4.17.0.

Detection Guidance

This vulnerability requires checking WordPress sites using the PublishPress Authors plugin up to version 4.17.0. Inspect user profiles for malicious scripts in the display_name field. Check plugin version in WordPress admin under Plugins. No direct commands are provided, but review user accounts with author terms assigned.

Impact Analysis

An attacker could exploit this to inject arbitrary web scripts into pages. When users access these pages, the scripts execute, potentially stealing cookies, session tokens, or other sensitive data. This requires the attacker's account to be mapped as an author, which happens if an admin assigns them as a co-author or enables automatic author term creation.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information (PHI) if exploited, risking compliance with security rule requirements. Organizations using this plugin must address it to maintain regulatory compliance.

Mitigation Strategies

Update the PublishPress Authors plugin to the latest version immediately. Remove any unauthorized user accounts with author terms. Review user profiles for injected scripts in display_name. Restrict subscriber-level access to only necessary users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111592. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart