CVE-2026-85657 is a stored cross-site scripting vulnerability in the PublishPress Authors WordPress plugin, affecting the Co-Authors, Multiple Authors and Guest Authors in an Author Box feature. The vulnerability arises from improper neutralization of input in the 'profile_fields_user_email_value_prefix' parameter, allowing authenticated users with Author-level access or higher to inject arbitrary web scripts. These scripts execute when users click on affected links, potentially leading to session hijacking or other script-based attacks. The issue is present in all versions up to and including 4.15.0.

An authenticated attacker with Author-level or higher privileges can exploit this vulnerability to inject malicious scripts that execute in the context of other users viewing affected pages. This can lead to partial confidentiality and integrity loss (e.g., theft of session tokens or manipulation of page content). There is no impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict Author-level access to trusted users only and consider additional input validation or output escaping controls if possible. Monitor vendor channels for updates and apply official fixes once released.