CVE-2026-85657

Name of the Vulnerable Software and Affected Versions Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors versions prior to 4.15.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Author-level access or higher can inject arbitrary web scripts via the profile fields user email value prefix parameter. These scripts execute when a user clicks on a link.

Recommendations Update to a version newer than 4.15.0. Avoid using the profile fields user email value prefix parameter until the update is applied.