Security Alert Summary
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress has a stored cross-site scripting (XSS) vulnerability via the name parameter (maps to display_name) in affected versions. Authenticated users with subscriber-level access and above who have a mapped author term can inject scripts that execute when other users view the affected pages.
CVE Details
- CVE ID:
CVE-2026-111592 - Affected component: Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
- Affected versions: All versions up to and including 4.17.0
- Published: October 31, 2026 at 8:16:48 AM UTC
- Last modified: October 31, 2026 at 8:16:48 AM UTC
- CVSS v3.1: Base Score 6.4, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction:
- Authentication: Required (attacker must be an authenticated user)
- Privileges required: Low (subscriber-level and above)
- User interaction: None
- Scope: Changed
- Primary impact:
- Confidentiality: Low
- Integrity: Low
- Availability: None
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The plugin fails to sufficiently sanitize input and escape output for the name parameter (which maps to display_name). This allows stored cross-site scripting (XSS) in all versions up to and including 4.17.0. When an attacker with an authenticated account that has a mapped author term provides a crafted value for name, that value can be stored and later rendered in pages without proper escaping, causing the injected script to execute in the context of users who view the page.
The vulnerability requires that the attacker account be associated with a mapped author term. That mapping is created when an administrator assigns the user as a co-author on content or when automatic author term creation for the user role is enabled; the mapping is not present by default for new users on a stock install.
Relevant source locations referenced in the advisory include plugin files such as src/core/Classes/Author_Editor.php and src/modules/multiple-authors/multiple-authors.php in the plugin tag referenced for affected versions. The underlying cause is insufficient input sanitization and output escaping for author name data before storage or rendering.
How This Could Impact Your Website
Consider a site with several user types: a site owner, internal staff editors, and an external contractor or contributor. If an attacker contributor or contractor account has been mapped to an author term (for example, after being assigned as a co-author), that attacker could store JavaScript in their display name. When other staff or site visitors view pages that render the unsafe display name, the script could run in their browsers.
- Exposure of internal user email addresses or profile details may occur if injected scripts are used to read or exfiltrate page content visible to logged-in users.
- Injected scripts can increase the risk of targeted phishing or social engineering by manipulating page content or capturing session-visible data used to craft convincing messages.
- Because the impact to confidentiality and integrity is rated low, this issue does not necessarily permit full site takeover, but it can enable persistent client-side attacks against users who view affected pages.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and any accounts with mapped author terms.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and regularly audit active extensions.
- Monitor site activity and logs for unusual behavior, including unexpected author term assignments or content updates.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/publishpress-authors/tags/4.17.0/src/core/Classes/Author_Editor.php#L86
- https://plugins.trac.wordpress.org/browser/publishpress-authors/tags/4.17.0/src/modules/multiple-authors/multiple-authors.php#L302
- https://plugins.trac.wordpress.org/browser/publishpress-authors/tags/4.17.0/src/modules/multiple-authors/multiple-authors.php#L5233
- https://plugins.trac.wordpress.org/browser/publishpress-authors/tags/4.18.0/src/core/Classes/Author_Editor.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/329226bc-7d0e-45e0-8ac0-656517e0e4ca?source=cve
