The vulnerability identified as CVE-2026-27365 in PublishPress Series is a CWE-79 type, involving improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). This flaw affects PublishPress Series versions up to 2.17.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low to low levels. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker with high privileges and requiring user interaction to execute stored XSS attacks, potentially impacting confidentiality, integrity, and availability of the affected system at a low level. This could lead to unauthorized script execution in the context of the affected web application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit high privilege user interactions with untrusted content and monitor for suspicious activity related to stored XSS.