Skip to content
Sign in
4.2 Medium

CVE-2026-11570 The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in…

Description

The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting that can be triggered by unauthenticated users when a non-default display option is enabled.

Affected products and versions

Product Affected versions Fixed in
User Submitted Posts 20260608 earliest → < 20260608 20260608

Other CVEs of User Submitted Posts

The 2 CVEs of User Submitted Posts →
CVE-2024-5002 The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which… 4.8 Medium
Track this CVE