CVE-2026-11570 — User Submitted Posts < 20260608 - Unauthenticated Stored XSS via Author Name
The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cr…
Published: 2026-07-01 · CVSS: 4.2 · CVSS 3.1
The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting that can be triggered by unauthenticated users when a non-default display option is enabled.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7