CVE-2026-5247: 
WordPress vulnerability analysis and mitigation

CVE-2026-5247 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Schedule Post Changes With PublishPress Future" plugin for WordPress, affecting all versions up to and including 4.10.0. The flaw resides in the wrapper attribute of the [futureaction] shortcode, where insufficient input sanitization allows authenticated attackers to inject arbitrary web scripts into pages. It was published on May 5, 2026, with a patch released in version 4.10.1. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), assigned by Wordfence (GitHub Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), stemming from a flawed sanitization approach in ShortcodeController.php. The plugin applies esc_html() to the wrapper attribute value, which only encodes HTML entities but does not prevent attribute injection when the value is used as an HTML tag name inside a sprintf() call. An attacker can insert spaces within the wrapper value to inject event handler attributes (e.g., onclick, onerror) that are rendered directly into the HTML output. The vulnerable code path is visible in the plugin's source at src/Modules/Expirator/Controllers/ShortcodeController.php#L173 (GitHub Advisory, PublishPress Releases).

Successful exploitation results in persistent (stored) XSS payloads executing in the browsers of any user who visits an affected page, impacting confidentiality (session token theft, credential harvesting) and integrity (page content manipulation). While availability is not directly impacted, the stored nature of the attack means all site visitors are at risk, not just administrators. If administrators delegate shortcode usage to contributors or other lower-privileged roles, the attack surface expands significantly beyond the default high-privilege requirement (GitHub Advisory, Wordfence).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires authenticated access at the administrator level or above (unless administrators have delegated shortcode access to lower-privileged users such as contributors), which limits opportunistic exploitation. The EPSS score is approximately 0.028% (0.04% per GitHub Advisory), placing it in the 12th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Wordfence).

1. Identify target: Locate a WordPress site running the PublishPress Future plugin version 4.10.0 or earlier with the [futureaction] shortcode enabled.
2. Obtain authenticated access: Log in with an administrator-level account, or a lower-privileged account (e.g., contributor) if the administrator has granted shortcode access to that role.
3. Craft malicious shortcode: Create or edit a post/page and insert a [futureaction] shortcode with a crafted wrapper attribute containing spaces followed by an event handler, e.g., [futureaction wrapper="div onclick=alert(document.cookie)"].
4. Publish the page: Save and publish the page containing the malicious shortcode. The injected attribute is stored in the database and rendered in the HTML output.
5. Trigger payload execution: When any user (including unauthenticated visitors) loads the affected page, the injected event handler executes in their browser, enabling session hijacking, credential theft, or further malicious actions (GitHub Advisory, PublishPress Releases).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing [futureaction with unusual wrapper attribute values including spaces and JavaScript event handler keywords (e.g., onclick, onerror, onload).
• Database: Suspicious entries in the wp_posts or wp_postmeta tables containing [futureaction wrapper= shortcodes with embedded event handler attributes or JavaScript URIs.
• Network: Outbound requests from user browsers to unexpected external domains following page visits, potentially indicating data exfiltration via injected scripts.
• File System: No direct file system artifacts expected for this stored XSS; however, review recently modified posts/pages for embedded [futureaction] shortcodes with non-standard wrapper values.

The vendor released version 4.10.1 on May 27, 2026, which specifically addresses CVE-2026-5247 by escaping [futureaction] shortcode output when rendered inside an HTML wrapper. Version 4.10.2 includes additional security hardening (permission checks, nonce verification, and further XSS escaping). Administrators should update to version 4.10.1 or later (4.10.2+ recommended) immediately. As a temporary workaround, restrict the use of the [futureaction] shortcode to trusted administrator accounts only and avoid delegating this functionality to lower-privileged roles. Implementing a Content Security Policy (CSP) can also reduce the impact of any stored XSS vulnerabilities (PublishPress Releases, Wordfence).

Wordfence included CVE-2026-5247 in their weekly WordPress vulnerability reports for both the May 4–10 and May 11–17, 2026 periods, and Sucuri highlighted it in their May 2026 vulnerability patch roundup. The vulnerability was responsibly disclosed by a researcher identified as "zaim," as credited in the plugin's official changelog. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability aggregator reporting (Wordfence Weekly Report, Sucuri Roundup).