CVE-2026-5247

The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper' attribute of the [futureaction] shortcode in all versions up to, and including, 4.10.0. This is due to insufficient input sanitization on the wrapper attribute. The plugin uses esc_html() to escape the value, but esc_html() only encodes HTML entities and does not prevent attribute injection when the value is used as an HTML tag name in a sprintf() call. An attacker can inject event handler attributes via spaces in the wrapper value. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Since it is also possible for administrators to make this functionality available to lower-privileged users, this introduces the possibility of abuse by contributors.

• CWE-79

• https://github.com/publishpress/publishpress-future/releases
• https://plugins.trac.wordpress.org/browser/post-expirator/tags/4.9.4/src/Modules/Expirator/Controllers/ShortcodeController.php#L173
• https://plugins.trac.wordpress.org/browser/post-expirator/trunk/src/Modules/Expirator/Controllers/ShortcodeController.php#L173
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9acf80aa-8354-4430-9836-18fa17854521?source=cve

Published

May 5, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52439An issue in xiandafu beetl 3.20.2 allows a remote attacker t…9.8
• CVE-2026-5244A vulnerability has been found in Cesanta Mongoose up to 7.2…9.8
• CVE-2026-5245A vulnerability was found in Cesanta Mongoose up to 7.20. Th…8.1
• CVE-2026-5246A vulnerability was determined in Cesanta Mongoose up to 7.2…8.1
• CVE-2026-52466Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerabl…9.8
• CVE-2026-52469SQL injection vulnerability in Crocus v.1.3.44 allows a remo…9.8
• CVE-2026-52470SQL injection vulnerability in Crocus v.1.3.44 allows a remo…9.8
• CVE-2026-52472SQL injection vulnerability in Wgcloud 3.6.4 allows a remote…9.8
• CVE-2026-52474An issue in aiflowy <= 2.1.2 allows a remote attacker to obt…7.5
• CVE-2026-52475Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allow…6.1
• CVE-2026-52476SQL Injection vulnerability in aiflowy <= 2.1.2 allows a rem…7.5
• CVE-2026-5248A vulnerability has been found in gougucms 4.08.18. This aff…6.3