Vulnerabilities / SchedulePress
SchedulePress vulnerabilities
Advisories WPSec published for SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher. Other sources may list more. Its attack surface: SchedulePress on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-19 | WPSEC-2026-1249 | SchedulePress <= 5.3.4 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Publishing and Status Change via Elementor Schedule Modal | Medium 5.4 | 5.3.5 |
| 2026-10-19 | WPSEC-2026-1248 | SchedulePress <= 5.3.4 - Authenticated (Contributor+) Missing Authorization to Post Publishing and Scheduling via Post Panel and Calendar REST Endpoints | Medium 4.3 | 5.3.5 |
License: CC BY 4.0