What is the CVSS score of CVE-2026-11570?

CVE-2026-11570 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-11570?

Yes, a public proof-of-concept exploit is available for CVE-2026-11570. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-11570?

Yes, a patch is available for CVE-2026-11570. Update the affected software to the latest version immediately.

User Submitted Posts CVE-2026-11570

EUVD-2026-40917 MEDIUM

2026-07-01 WPScan

GHSA-qrfm-jqh3-mc7c

WordPress XSS User Submitted Posts Unknown

4.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

4.2 MEDIUM

AC:H reflects the non-default admin configuration prerequisite; PR:N because payload submission is unauthenticated; UI:R because a victim must view the rendered template.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 11:27 vuln.today

CVSS changed

Jul 01, 2026 - 11:22 NVD

4.2 (None) 4.2 (MEDIUM)

Patch available

Jul 01, 2026 - 08:01 EUVD

CVE Published

Jul 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 06:00 cve.org

MEDIUM 4.2

DescriptionCVE.org

The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting that can be triggered by unauthenticated users when a non-default display option is enabled.

AnalysisAI

Stored Cross-Site Scripting in the User Submitted Posts WordPress plugin before version 20260608 enables unauthenticated attackers to inject persistent malicious scripts into admin-configured display templates. The vulnerability is only reachable when a site administrator has enabled a non-default display option in the plugin settings, limiting its real-world exposure. A publicly available proof-of-concept exploit exists per WPScan, though no active exploitation has been confirmed by CISA KEV at time of analysis.

Technical ContextAI

User Submitted Posts is a WordPress plugin that allows front-end visitors to submit posts without logging in. The vulnerability stems from the plugin storing user-submitted field values without sanitization and then rendering those values directly into an admin-configured display template without HTML entity encoding or escaping. This is a classic output-encoding failure consistent with CWE-79 (Improper Neutralization of Input During Web Page Generation), though CWE is listed as N/A in the NVD record. The affected code path is only activated when a specific non-default display option is toggled on by the site administrator, narrowing the exposure surface. The CPE identifier cpe:2.3:a:unknown:user_submitted_posts:*:*:*:*:*:*:*:* covers all versions of the plugin prior to the 20260608 release, with the vendor field unresolved in the NVD record.

RemediationAI

Update the User Submitted Posts WordPress plugin to version 20260608 or later, which introduces proper output escaping for user-submitted values rendered in display templates. This is confirmed as the vendor-released patch per WPScan (https://wpscan.com/vulnerability/35c33c56-5b12-4be5-9d45-68f47cd854ec/) and the NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-11570). If immediate patching is not feasible, administrators should disable the specific non-default display option that activates the vulnerable rendering path - this eliminates the attack surface entirely but will reduce the display functionality the option provides. Additionally, review recently submitted posts for suspicious script content (script tags, javascript: URIs, event handler attributes) as part of incident triage while the patch is pending. Do not rely solely on Web Application Firewall rules as a long-term control, since stored XSS payloads can be obfuscated to bypass signature-based filters.