CVE-2026-111592

Name of the Vulnerable Software and Affected Versions PublishPress Authors versions prior to 4.17.1

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the name (which maps to display name) parameter, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. Exploitation requires the attacker's account to have a mapped author term, which happens if an administrator assigns them as a co-author or enables automatic author term creation for their role.

Recommendations Update to version 4.17.1 or later.