CVE-2026-5247 is a stored cross-site scripting vulnerability in the Schedule Post Changes With PublishPress Future WordPress plugin affecting all versions up to 4.10.0. The issue stems from insufficient sanitization of the 'wrapper' attribute in the [futureaction] shortcode. The plugin escapes the attribute value using esc_html(), which only encodes HTML entities but does not prevent injection of event handler attributes when the value is used as an HTML tag name within a sprintf() call. This allows authenticated users with administrator privileges to inject arbitrary JavaScript code that executes in the context of users viewing the affected pages. The vulnerability also poses a risk if administrators enable this functionality for lower-privileged users such as contributors.

An attacker with administrator-level access can exploit this vulnerability to inject arbitrary web scripts that execute in the browsers of users who view the affected pages. This can lead to unauthorized actions, data theft, or session hijacking within the context of the WordPress site. The vulnerability requires high privileges to exploit and does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator-level access to trusted users only and avoid enabling the vulnerable shortcode functionality for lower-privileged users. Monitor official PublishPress channels for updates and apply any official patches or updates promptly once released.