SchedulePress vulnerabilities

CVEs whose affected-version data names the SchedulePress package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-114120Medium· 5.4

today

SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wps…

▾ SunlitWPDeveloper · SchedulePressvia CVEORG