PublishPress has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was September 2026 with 5. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. Most affected products: organize-series (3), Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors (1), User Role Editor – PublishPress Capabilities: Access Control and User Roles (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Products
- organize-series 3
- Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors 1
- User Role Editor – PublishPress Capabilities: Access Control and User Roles 1
Worst active — by depth score
CVE-2026-66630High· 7.6Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.42CVE-2026-75927High· 7.2PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant40CVE-2026-66617Medium· 6.5Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.36CVE-2026-74005Medium· 5.4Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.30CVE-2026-85657Medium· 5.4The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profile_fields_user_email_value_prefix’ parameter in all versions up…30
PublishPress vulnerabilities
CVEs affecting PublishPress, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-74005Medium· 5.4Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.
CVE-2026-66630High· 7.6Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.
Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.
CVE-2026-66617Medium· 6.5Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.
Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.
CVE-2026-85657Medium· 5.4The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profile_fields_user_email_value_prefix’ parameter in all versions up…
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profile_fields_user_email_value_prefix’ parameter in all versions up…
CVE-2026-75927High· 7.2PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant
The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCa…