CVE-2026-111592

The record

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (maps to display_name)' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker's user account to have a mapped author term, which occurs when an administrator has assigned them as a co-author on content or has enabled automatic author term creation for their role — this mapping is not present by default for new users on a stock install.

Affected packages

Related vulnerabilities

• CVE-2026-115541 HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in… CWE-79
• CVE-2026-82160 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper… CWE-79
• CVE-2026-82161 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper… CWE-79
• CVE-2026-82158 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper… CWE-79
• CVE-2026-82159 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper… CWE-79
• CVE-2025-71451 Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting… CWE-79
• CVE-2025-71452 Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting… CWE-79
• CVE-2026-63197 traQ is a messenger application built for Digital Creators Club traP. CWE-79