{"id":"CVE-2026-105261","title":"The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise…","summary":"The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-79"],"published":"2026-10-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T16:14:02.800","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105261","references":[{"url":"https://wpscan.com/vulnerability/b340566c-6c45-4391-aefe-76ae7f5ba77f/","label":"contact@wpscan.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-14T07:21:04.832Z","product":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories","affected":["schedule_post_changes_with_publishpress_future_unpublish_delete_change_status_trash_change_categories >= 4.10.1 < 4.10.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-14T13:31:54.386389Z"},"epss":0.00311,"epssPercentile":0.23811,"slug":"CVE-2026-105261","body":"## Overview\n\nThe Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":220232,"id":"CVE-2026-105261","ts":1791992299772,"field":"cvss","old":null,"new":"6.8"},{"seq":220231,"id":"CVE-2026-105261","ts":1791992299772,"field":"severity","old":"none","new":"medium"}]}