CVE-2026-85657: Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter

Medium severity · published Sep 15, 2026

CVE-2026-85657

Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter

5.4

CVSS

0.2%

EPSS

On KEV

Description

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profile_fields_user_email_value_prefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on a link.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 14% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors · publishpress

through 4.15.0 · source: vendor

Affected product

Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors

publishpress

All Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-85657

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-85657

plugins.trac.wordpress.org

https://plugins.trac.wordpress.org/browser/publishpress-authors/tags/4.15.0/src/modules/author-boxes/author-boxes.php#L2019

www.wordfence.com

https://www.wordfence.com/threat-intel/vulnerabilities/id/d4cc9537-879c-4c12-8b76-60241b7a3420?source=cve

More from Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors

8.8

CVE-2024-9215

Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover