The PublishPress Future WordPress plugin fails to enforce a safe HTML‑element whitelist on the ‘wrapper’ and ‘dateformat’ shortcode attributes. Because the plugin does not neutralise attacker‑controlled text inserted behind these attributes, users with Contributor or higher privileges can store and publish arbitrary JavaScript. When a higher‑privileged user views content containing the injected shortcode, the script executes in that user’s browser session.

Affected installations include WordPress sites running PublishPress Future plugin versions 4.10.1 through 4.10.5. The vulnerability is limited to posts that use the vulnerable shortcodes and to users who have at least Contributor access to post editing or creation.

The EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of exploitation at present. The CVSS score of 6.8 classifies the risk as medium severity. The attack vector is internal: an attacker must possess or compromise a Contributor account (or higher) to embed malicious shortcode content; the impact manifests through injection of executable JavaScript in the browsers of users who view the affected posts.