CVE-2026-27365 is a stored cross-site scripting (XSS) vulnerability in PublishPress Series affecting versions up to and including 2.17.0. The issue arises from improper neutralization of input during web page generation, which could allow an attacker with high privileges to inject malicious scripts that execute when other users view the affected pages. The vulnerability has a CVSS 3.1 score of 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L), indicating network attack vector, low attack complexity, high privileges required, user interaction required, and partial impact on confidentiality, integrity, and availability.

An attacker with high privileges can exploit this vulnerability to inject stored malicious scripts that execute in the context of other users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The impact is limited by the requirement for high privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit high-privilege user access and apply standard web security controls to mitigate stored XSS risks.