CVE-2026-11570
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The User Submitted Posts WordPress plugin before version 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting vulnerability. This can be triggered by unauthenticated users when a non-default display option is enabled.
Risk Assessment
An attacker can inject malicious JavaScript that executes in the browsers of administrators or other visitors, potentially leading to session hijacking, defacement, or further attacks.
Recommendation
Immediately update the User Submitted Posts plugin to version 20260608 or later. If updating is not possible, disable the non-default display option in the plugin settings.
Other vulnerabilities in User Submitted Posts
See all- CVE-2026-62084Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in User Submitted Posts allows Stored XSS. Affects versions from n/a through 20260810.
- CVE-2025-68509Medium
The WordPress plugin 'User Submitted Posts' up to version 20251121 has an Open Redirect vulnerability that could be used for phishing.
Original NVD description (English source)
The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting that can be triggered by unauthenticated users when a non-default display option is enabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS