Please don't report security problems in public issues or pull requests.

Report them privately through GitHub: Report a vulnerability. Include the SchedulePress version, the steps to reproduce, and what an attacker could do. We'll reply on the advisory and credit you when the fix ships, unless you'd rather stay anonymous.

Only the latest release gets security fixes.