Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories

Information

Software Type Plugin
Software Slug post-expirator (view on wordpress.org)
Software Status Active
Software Author publishpress
Software Website wordpress.org
Software Downloads 4,327,052
Software Active Installs 100,000
Software Record Last Updated August 17, 2026

7 Vulnerabilities

Submit a Vulnerability
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute
5.5
CVE-2026-5247
May 4, 2026
Researcher: zaim
Post Expirator <= 4.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-39482
Mar 22, 2026
Researcher: timomangcut
Post Expirator <= 4.9.3 - Missing Authorization
4.3
CVE-2025-69361
Jan 11, 2026
Researcher: Bao - BlueRock
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation
5.4
CVE-2025-14718
Jan 8, 2026
Researcher: Athiwat Tiprasaharn (Jitlada)
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) Authors' Emails Exposure
4.3
CVE-2025-13741
Dec 15, 2025
Researcher: Athiwat Tiprasaharn (Jitlada)
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification
4.3
CVE-2025-13149
Nov 20, 2025
Researcher: Athiwat Tiprasaharn (Jitlada)
Post Expirator <= 2.5.1 - Contributor+ Arbitrary Post Schedule Deletion
4.3
CVE-2021-24783
Oct 11, 2021
Researcher: apple502j
Title Status CVE ID CVSS Researchers Date
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute Patched CVE-2026-5247 5.5 zaim May 4, 2026
Post Expirator <= 4.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-39482 6.4 timomangcut March 22, 2026
Post Expirator <= 4.9.3 - Missing Authorization Patched CVE-2025-69361 4.3 Bao - BlueRock January 11, 2026
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation Patched CVE-2025-14718 5.4 Athiwat Tiprasaharn (Jitlada) January 8, 2026
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) Authors' Emails Exposure Patched CVE-2025-13741 4.3 Athiwat Tiprasaharn (Jitlada) December 15, 2025
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification Patched CVE-2025-13149 4.3 Athiwat Tiprasaharn (Jitlada) November 20, 2025
Post Expirator <= 2.5.1 - Contributor+ Arbitrary Post Schedule Deletion Patched CVE-2021-24783 4.3 apple502j October 11, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation