The vulnerability arises from insufficient sanitization of the 'wrapper' attribute in the [futureaction] shortcode. The plugin incorrectly uses esc_html() to escape user input, but the value is later inserted as an HTML tag name via sprintf. This allows attackers to inject event handler attributes by inserting a space in the wrapper value. An authenticated administrator can use the shortcode to place arbitrary script in a post, and if the plugin is configured to expose this to lower‑privileged users, contributors can also exploit it. The result is stored Cross‑Site Scripting, enabling the attacker to run malicious JavaScript whenever any site visitor views the affected content.

This flaw affects the PublishPress Schedule Post Changes With PublishPress Future plugin for WordPress. All plugin releases up to and including version 4.10.0 are vulnerable. The issue manifests when the [futureaction] shortcode is used in content, posts, or widgets.

The CVSS score of 5.5 indicates medium severity, and the exploit requires authenticated access with at least administrator privileges. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. Exploitation is straightforward for administrators: they can edit a post, add the shortcode with a malicious wrapper value, and save it. The injected script will execute for any visitor to that page, leading to potential credential theft, session hijacking, or defacement. The limited attack vector (requires authentication and plugin use) reduces the likelihood of remote exploitation but does not eliminate risk for organizations with active contributors or administrators who may inadvertently misuse the shortcode.