Skip to content
OpenAdvisories

Vendor

publishpress

33 known vulnerabilities.

Products

PublishPress Series 5 PublishPress Authors 5 Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories 4 PublishPress Capabilities 4 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors 3 PublishPress Revisions 3 PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes 2 Gutenberg Blocks 2 Post Expirator 2 PublishPress Blocks – Block Controls, Block Visibility, Block Permissions 1 PublishPress Permissions 1 User Role Editor – PublishPress Capabilities: Access Control and User Roles 1
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.2
    CVE-2026-48197

    WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.

    publishpress PublishPress Capabilities
  • High 8.1
    CVE-2026-94487

    WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.

    publishpress PublishPress Capabilities
  • High 7.6
    CVE-2026-66630

    WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability

    Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.

    publishpress PublishPress Series
  • High 7.2
    CVE-2026-75927

    PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

    The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function…

    publishpress User Role Editor – PublishPress Capabilities: Access Control and User Roles Web / CMS
  • High 7.2
    CVE-2026-28183

    WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.

    publishpress PublishPress Capabilities
  • High 7.5
    CVE-2026-25309

    WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Authors: from n/a through <= 4.10.1.

    publishpress PublishPress Authors
  • High 7.5
    CVE-2025-48332

    WordPress Gutenberg Blocks <= 3.3.1 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows PHP Local File Inclusion.This issue affects Gutenberg Blocks: from n/a through <= …

    publishpress Gutenberg Blocks
  • High 7.5
    CVE-2025-47496

    WordPress PublishPress Authors plugin <= 4.7.5 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PublishPress PublishPress Authors publishpress-authors allows PHP Local File Inclusion.This issue affects PublishPress Authors: from n/a t…

    publishpress PublishPress Authors
  • High 7.6
    CVE-2025-26886

    WordPress PublishPress Authors plugin <= 4.7.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Authors publishpress-authors allows SQL Injection.This issue affects PublishPress Authors: from n/a through <= 4.7.3.

    publishpress PublishPress Authors
  • High 8.8
    CVE-2024-9215

    Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover

    The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Insecure Direct Object Reference to Privilege Escalation/Account Takeover in all versions up to, and including, 4.7.1 via the a…

    publishpress Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors Web / CMS