CVE-2026-62084
MediumCVSS 6.5Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in User Submitted Posts allows Stored XSS. Affects versions from n/a through 20260810.
Risk Assessment
An attacker could inject malicious script that executes in users' browsers, potentially leading to data theft, session hijacking, or other attacks.
Recommendation
Update the User Submitted Posts plugin to a version newer than 20260810 if a fix is available.
Other vulnerabilities in User Submitted Posts
See all- CVE-2026-11570Medium
The User Submitted Posts WordPress plugin before version 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting vulnerability. This can be triggered by unauthenticated users when a non-default display option is enabled.
- CVE-2025-68509Medium
The WordPress plugin 'User Submitted Posts' up to version 20251121 has an Open Redirect vulnerability that could be used for phishing.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS