CVE-2026-105261 PublishPress CVE debrief

Who should care

Defenders responsible for WordPress installations using the Schedule Post Changes With PublishPress Future plugin should assess exposure and prioritize remediation. This includes reviewing the plugin's version, restricting the Contributor role and above to only necessary users, and monitoring for suspicious activity on the WordPress installation.

Why it matters

The CVE-2026-105261 vulnerability in the Schedule Post Changes With PublishPress Future plugin allows an attacker with the Contributor role or higher to inject JavaScript code, which can be executed in the session of a higher-privileged user. Defenders should prioritize verifying the presence of this vulnerability and applying updates to prevent exploitation.

• An attacker could inject malicious JavaScript code, potentially leading to unauthorized actions or data theft.
• The vulnerability requires verification of the plugin version and application of updates to prevent exploitation.
• Defenders should monitor for suspicious activity on the WordPress installation to detect potential exploitation attempts.

Technical summary

The Schedule Post Changes With PublishPress Future WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content. This vulnerability can be exploited by an attacker with the Contributor role or higher, potentially leading to unauthorized actions or data theft.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and applying the necessary updates to prevent exploitation.

Recommended defensive actions

• Verify the version of the Schedule Post Changes With PublishPress Future plugin and update to version 4.10.6 or later if necessary.
• Restrict the Contributor role and above to only necessary users.
• Monitor for suspicious activity on the WordPress installation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the corpus does not provide information on exploitation or impact. Defenders should verify the presence of the Schedule Post Changes With PublishPress Future plugin in their WordPress installations and review the plugin's version to determine if it is vulnerable. The CVE Program record and NVD detail page provide additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.