Post Expirator Vulnerabilities

The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper' attribute of the [futureaction] shortcode in all versions up to, and including, 4.10.0. This is due to insufficient input sanitization on the wrapper attribute. The plugin uses esc_html...

CVSS:

5.5

Affected:

up to 4.10.0

Fixed in:

4.10.1

Disclosed:

May 4, 2026

CVE-2026-5247 on NVD →

The Post Expirator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages t...

CVSS:

6.4

Affected:

up to 4.9.4

Fixed in:

4.10.0

Disclosed:

Mar 22, 2026

CVE-2026-39482 on NVD →

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.9.3. This makes it possible for authenticated attackers, with C...

CVSS:

4.3

Affected:

up to 4.9.3

Fixed in:

4.9.4

Disclosed:

Jan 11, 2026

CVE-2025-69361 on NVD →

[en] The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contri...

Affected:

up to 4.9.4

Fixed in:

4.9.4

Disclosed:

Jan 9, 2026

CVE-2025-14718 on NVD →

The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor...

CVSS:

5.4

Affected:

up to 4.9.3

Fixed in:

4.9.4

Disclosed:

Jan 8, 2026

CVE-2025-14718 on NVD →

[en] Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Expirator: from n/a through <= 4.9.3.

Affected:

up to 4.9.3

Fix:

No patched version reported

Disclosed:

Jan 6, 2026

CVE-2025-69361 on NVD →

[en] The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getAuthors function in all versions up to, and including, 4.9.2. This makes it possible for authe...

Affected:

up to 4.9.3

Fixed in:

4.9.3

Disclosed:

Dec 16, 2025

CVE-2025-13741 on NVD →

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getAuthors function in all versions up to, and including, 4.9.2. This makes it possible for authentica...

CVSS:

4.3

Affected:

up to 4.9.2

Fixed in:

4.9.3

Disclosed:

Dec 15, 2025

CVE-2025-13741 on NVD →

[en] The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including, 4.9.1. This makes...

Affected:

up to 4.9.2

Fixed in:

4.9.2

Disclosed:

Nov 21, 2025

CVE-2025-13149 on NVD →

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including, 4.9.1. This makes it po...

CVSS:

4.3

Affected:

up to 4.9.1

Fixed in:

4.9.2

Disclosed:

Nov 20, 2025

CVE-2025-13149 on NVD →

Upgrade this plugin. An unknown person discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Post Expirator Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in...

Affected:

up to 2.1.2

Fixed in:

2.1.2

Disclosed:

Aug 1, 2023

[en] The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.

Affected:

up to 2.6.0

Fixed in:

2.6.0

Disclosed:

Nov 8, 2021

CVE-2021-24783 on NVD →

The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.

CVSS:

4.3

Affected:

up to 2.5.1

Fixed in:

2.6.0

Disclosed:

Oct 11, 2021

CVE-2021-24783 on NVD →

This plugin is prone to a cross site request forgery vulnerability. Upgrade this plugin.

Affected:

up to 2.1.2

Fixed in:

2.1.2

Disclosed:

Aug 1, 2014

The Post Expirator WordPress plugin was affected by a Cross-Site Request Forgery security vulnerability.

Affected:

up to 2.1.2

Fixed in:

2.1.2