Search
Find a vulnerability
Search criteria
4 vulnerabilities found for PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes by publishpress
CVE-2024-11154 (GCVE-0-2024-11154)
Vulnerability from nvd – Published: 2024-11-20 13:55 – Updated: 2026-04-08 17:21
VLAI
Title
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
Summary
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the 'actAjaxRevisionDiffs' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| publishpress | PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes |
Affected:
0 , ≤ 3.5.15
(semver)
|
|
| kevinb | publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes |
Affected:
0 , ≤ 3.5.15
(semver)
cpe:2.3:a:kevinb:publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:kevinb:publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes",
"vendor": "kevinb",
"versions": [
{
"lessThanOrEqual": "3.5.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-20T14:32:46.225820Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-20T14:36:45.683Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes",
"vendor": "publishpress",
"versions": [
{
"lessThanOrEqual": "3.5.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dominik Dziura"
}
],
"descriptions": [
{
"lang": "en",
"value": "The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the \u0027actAjaxRevisionDiffs\u0027 function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:21:26.143Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c785b7a0-5091-4d89-87d3-cd7d9984553e?source=cve"
},
{
"url": "https://github.com/publishpress/PublishPress-Revisions/blob/master/admin/history_rvy.php#L322"
},
{
"url": "https://plugins.trac.wordpress.org/browser/revisionary/trunk/admin/history_rvy.php#L322"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3192492/"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-11-19T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes \u003c= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-11154",
"datePublished": "2024-11-20T13:55:13.662Z",
"dateReserved": "2024-11-12T17:40:03.390Z",
"dateUpdated": "2026-04-08T17:21:26.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-9436 (GCVE-0-2024-9436)
Vulnerability from nvd – Published: 2024-10-11 06:50 – Updated: 2026-04-08 17:10
VLAI
Title
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.14 - Reflected Cross-Site Scripting
Summary
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.14. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| publishpress | PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes |
Affected:
0 , ≤ 3.5.14
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-11T15:42:58.445035Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-11T15:43:11.294Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes",
"vendor": "publishpress",
"versions": [
{
"lessThanOrEqual": "3.5.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "vgo0"
}
],
"descriptions": [
{
"lang": "en",
"value": "The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.14. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:10:38.449Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/982bc924-1dcd-47b5-b15a-4ff0ad123ad1?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/revisionary/tags/3.5.14/admin/class-list-table_rvy.php#L717"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3165210/"
},
{
"url": "https://plugins.trac.wordpress.org/browser/revisionary/tags/3.5.14/admin/class-list-table-archive.php#L780"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-10-10T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes \u003c= 3.5.14 - Reflected Cross-Site Scripting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-9436",
"datePublished": "2024-10-11T06:50:18.179Z",
"dateReserved": "2024-10-02T16:03:17.245Z",
"dateUpdated": "2026-04-08T17:10:38.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-11154 (GCVE-0-2024-11154)
Vulnerability from cvelistv5 – Published: 2024-11-20 13:55 – Updated: 2026-04-08 17:21
VLAI
Title
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
Summary
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the 'actAjaxRevisionDiffs' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| publishpress | PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes |
Affected:
0 , ≤ 3.5.15
(semver)
|
|
| kevinb | publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes |
Affected:
0 , ≤ 3.5.15
(semver)
cpe:2.3:a:kevinb:publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:kevinb:publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes",
"vendor": "kevinb",
"versions": [
{
"lessThanOrEqual": "3.5.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-20T14:32:46.225820Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-20T14:36:45.683Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes",
"vendor": "publishpress",
"versions": [
{
"lessThanOrEqual": "3.5.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dominik Dziura"
}
],
"descriptions": [
{
"lang": "en",
"value": "The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the \u0027actAjaxRevisionDiffs\u0027 function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:21:26.143Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c785b7a0-5091-4d89-87d3-cd7d9984553e?source=cve"
},
{
"url": "https://github.com/publishpress/PublishPress-Revisions/blob/master/admin/history_rvy.php#L322"
},
{
"url": "https://plugins.trac.wordpress.org/browser/revisionary/trunk/admin/history_rvy.php#L322"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3192492/"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-11-19T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes \u003c= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-11154",
"datePublished": "2024-11-20T13:55:13.662Z",
"dateReserved": "2024-11-12T17:40:03.390Z",
"dateUpdated": "2026-04-08T17:21:26.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-9436 (GCVE-0-2024-9436)
Vulnerability from cvelistv5 – Published: 2024-10-11 06:50 – Updated: 2026-04-08 17:10
VLAI
Title
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.14 - Reflected Cross-Site Scripting
Summary
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.14. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| publishpress | PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes |
Affected:
0 , ≤ 3.5.14
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-11T15:42:58.445035Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-11T15:43:11.294Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes",
"vendor": "publishpress",
"versions": [
{
"lessThanOrEqual": "3.5.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "vgo0"
}
],
"descriptions": [
{
"lang": "en",
"value": "The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.14. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:10:38.449Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/982bc924-1dcd-47b5-b15a-4ff0ad123ad1?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/revisionary/tags/3.5.14/admin/class-list-table_rvy.php#L717"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3165210/"
},
{
"url": "https://plugins.trac.wordpress.org/browser/revisionary/tags/3.5.14/admin/class-list-table-archive.php#L780"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-10-10T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes \u003c= 3.5.14 - Reflected Cross-Site Scripting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-9436",
"datePublished": "2024-10-11T06:50:18.179Z",
"dateReserved": "2024-10-02T16:03:17.245Z",
"dateUpdated": "2026-04-08T17:10:38.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}