WPDeveloper SchedulePress vulnerabilities

Latest WPDeveloper SchedulePress CVEs

Newest publication first

1. CVE-2026-114120 SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action

   Published 2026-10-21

   Medium·CVSS 5.3 EPSS 0.29%

   SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal...

2. CVE-2024-6557 SchedulePress <= 5.1.3 - Unauthenticated Full Path Disclosure

   Published 2024-07-16

   Medium·CVSS 5.3 EPSS 0.44%

   The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.1.3. This is due the plugin utilizing the wpdevel...

3. CVE-2024-32717 WordPress SchedulePress plugin <= 5.0.8 - Broken Access Control vulnerability

   Published 2024-05-09

   Medium·CVSS 6.5 EPSS 0.60%

   Missing Authorization vulnerability in WPDeveloper SchedulePress.This issue affects SchedulePress: from n/a through 5.0.8.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.