CVE-2026-105261
MEDIUMCVSS 6.8Description
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content.
Timeline
Published:October 14th, 2026 7:17 AM
Last modified:October 14th, 2026 4:14 PM
CVSS Scoring
CVSS v3: 6.8 (MEDIUM)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
Source: NIST NVD · Data may lag official sources by up to one minute