The PublishPress Authors plugin processes the 'display_name' field for author terms without proper sanitization or escaping, creating a stored XSS vector. An attacker who is logged in as a subscriber or higher, who has been assigned as a co‑author or whose role is configured to auto‑create an author term, can inject JavaScript that will run whenever a page referencing the injected author term is rendered. The cross‑site scripting flaw is defined by CWE‑79 and allows the execution of arbitrary client‑side code, leading to defacement, credential theft, or redirection of site visitors.

PublishPress, specifically the PublishPress Authors WordPress plugin, version 4.17.0 and earlier. Versions 4.18.0 and above are not affected; any installation using these earlier releases is vulnerable.

The CVSS v3 base score is 6.4, indicating a medium severity vulnerability. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with subscriber-level privileges that is mapped to an author term, which administrators may enable during site configuration. Because the mapping is not automatically present for new users on a stock installation, the attack surface is limited, but once in place the vulnerability can be leveraged easily by the attacker. The risk is moderate, but a user with sufficient privileges could compromise any visitor interacting with affected pages.