CVE-2026-105261 PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes
Contributors can inject JavaScript via shortcode attributes, leading to session hijacking or data theft when higher-privileged users view the content.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-105261?
CVE-2026-105261 is a medium-severity cross-site scripting vulnerability in Unknown Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories, published on 14 Oct 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content.
Weakness: CWE-79
Which versions are affected by CVE-2026-105261?
How do I fix CVE-2026-105261?
No fix has been published for CVE-2026-105261 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-105261 being exploited?
There is no known exploitation of CVE-2026-105261 in the wild and no public exploit code.
Sources
Also known as GHSA-gfhc-x3j2-83wf.