{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39482", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:42:07.236Z", "datePublished": "2026-04-08T08:30:10.093Z", "dateUpdated": "2026-04-08T08:30:10.093Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "post-expirator", "product": "Post Expirator", "vendor": "PublishPress", "versions": [{"changes": [{"at": "4.10.0", "status": "unaffected"}], "lessThanOrEqual": "4.9.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "timomangcut | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:28:57.559Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Post Expirator post-expirator allows DOM-Based XSS.<p>This issue affects Post Expirator: from n/a through <= 4.9.4.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Post Expirator post-expirator allows DOM-Based XSS.This issue affects Post Expirator: from n/a through <= 4.9.4."}], "impacts": [{"capecId": "CAPEC-588", "descriptions": [{"lang": "en", "value": "DOM-Based XSS"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:10.093Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/post-expirator/vulnerability/wordpress-post-expirator-plugin-4-9-4-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "title": "WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Post Expirator post-expirator allows DOM-Based XSS.This issue affects Post Expirator: from n/a through <= 4.9.4."}], "id": "CVE-2026-39482", "lastModified": "2026-04-08T21:26:35.910", "metrics": {}, "published": "2026-04-08T09:16:22.830", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/post-expirator/vulnerability/wordpress-post-expirator-plugin-4-9-4-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.9.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Post Expirator", "source": "cna", "vendor": "PublishPress"}, "product": "post_expirator", "vendor": "publishpress"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T09:25:39.951052+00:00", "value": {"mitigation_remediation": ["Upgrade the PublishPress Post Expirator plugin to version 4.9.5 or later.", "If an upgrade is not immediately feasible, disable the Post Expirator plugin or restrict access to its pages to trusted users."], "summary": {"action": "Patch", "impact": "Client\u2011Side XSS"}, "threat_synthesis": {"affected_systems": "Any WordPress installation that has the PublishPress Post Expirator plugin installed in version 4.9.4 or earlier is affected. The plugin may appear under the name \u2018Post Expirator\u2019 in the WordPress plugin list. No additional product or vendor details are provided beyond the plugin name and affected versions.", "description_and_impact": "The PublishPress Post Expirator plugin has a DOM\u2011based Cross\u2011Site Scripting flaw that allows an attacker to inject malicious JavaScript into the web page at the time a post expiration page is generated. This improper neutralization of user input can lead to script execution within the victim\u2019s browser, potentially enabling actions such as session hijacking, defacement, or phishing. The vulnerability is identified as a standard XSS issue (CWE\u201179).", "risk_and_exploitability": "The vulnerability has a high potential impact due to its ability to execute arbitrary client\u2011side code. Specific CVSS details are not supplied, but XSS flaws typically score high on the CVSS scale. Exploitation requires that a victim load a crafted page, making it an interaction\u2011dependent attack. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely or publicly exploited. Nonetheless, the combination of high severity and user interaction makes it a significant risk for sites that expose post expiration pages to unauthenticated users."}}}}, "created": "2026-04-08T19:30:47.610627+00:00", "updated": "2026-04-08T19:43:16.440334+00:00", "vendors": ["publishpress", "publishpress$PRODUCT$post_expirator", "wordpress", "wordpress$PRODUCT$wordpress"]}