CVE-2025-68509
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
The WordPress plugin 'User Submitted Posts' up to version 20251121 has an Open Redirect vulnerability that could be used for phishing.
Risk Assessment
An attacker could redirect users to malicious sites, potentially leading to credential theft or malware infection.
Recommendation
Update the plugin to the latest version if a patch exists. Otherwise, consider restricting redirect functionality and educating users.
Other vulnerabilities in User Submitted Posts
See all- CVE-2026-62084Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in User Submitted Posts allows Stored XSS. Affects versions from n/a through 20260810.
- CVE-2026-11570Medium
The User Submitted Posts WordPress plugin before version 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting vulnerability. This can be triggered by unauthenticated users when a non-default display option is enabled.
Original NVD description (English source)
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Jeff Starr User Submitted Posts user-submitted-posts allows Phishing.This issue affects User Submitted Posts: from n/a through <= 20251121.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS