CVE-2026-27365

Deferred Deferred - Pending Action

Stored XSS in PublishPress Series Plugin

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-27365

EUVD

EUVD-2026-62212

Affected Vendors & Products

Vendor	Product	Version / Range
publishpress	publishpress_series	to 2.17.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in PublishPress Series. It occurs when user input is not properly neutralized during web page generation, allowing malicious scripts to be stored on the server and executed when other users view the page.

Detection Guidance

To detect this Stored XSS vulnerability in PublishPress Series, inspect web application logs for suspicious input patterns like script tags or event handlers in user-generated content. Check for unusual JavaScript execution in browser consoles when accessing pages with user input fields.

Impact Analysis

An attacker could inject malicious scripts into the PublishPress Series application. When other users access the affected pages, these scripts could steal sensitive data, perform unauthorized actions, or deface the website. The impact depends on user privileges and data exposure.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR (General Data Protection Regulation) by exposing personal data without consent. For HIPAA (Health Insurance Portability and Accountability Act), it may compromise protected health information, risking unauthorized access and penalties.

Mitigation Strategies

Immediately update PublishPress Series to the latest version beyond 2.17.0. If an update is unavailable, disable the plugin temporarily. Implement input validation and output encoding for user-supplied data. Review stored user content for malicious scripts.

Hi! I’m here to help you understand CVE-2026-27365. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70