User Submitted Posts EUVD-2026-114603

Exploitation requires the plugin's public front-end submission form (shortcode) to be exposed to visitors, and the attacker injects via the 'user-submitted-content' parameter. The critical limiting factor is moderation mode: on a DEFAULT installation the submitted post is held as Pending and an administrator must approve it before the stored payload is reachable by other visitors, which both delays execution and gives a moderator a chance to catch it; the fully unauthenticated, no-interaction path only exists when the non-default 'publish immediately' option is enabled, in which case the payload goes live with no approval step. Execution occurs when a user (visitor or reviewing admin) accesses the page containing the stored payload. Scope of impact is limited to in-browser script execution (session data, actions as the viewing user), not direct server compromise.

Signals are mixed and point to a real-but-bounded priority rather than an emergency. The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) is elevated mainly by the scope change (S:C) that stored XSS earns for executing in other users' browser context, while the actual confidentiality and integrity impacts are both Low and availability is None. The vuln.today decision label is 'this_week' (not act_now/emergency), which is consistent with a non-critical, config-dependent stored XSS. No EPSS probability was supplied, there is no CISA KEV listing (not confirmed actively exploited), and no verified public exploit code is present - the references are the Wordfence advisory, WordPress plugin source lines, and the fix changeset, not a working PoC. The most important nuance is that the CVSS vector reads as fully unauthenticated, no-interaction (PR:N/UI:N), but the description states that on a DEFAULT installation submissions are held as Pending and require admin approval before the payload becomes reachable; the no-interaction path only exists when the non-default 'publish immediately' option is enabled. This means the raw vector slightly overstates real-world exploitability for default deployments - verify the site's submission/moderation configuration before treating this as drive-by exploitable.

An unauthenticated attacker submits a post through the plugin's public front-end form, placing a malicious script in the 'user-submitted-content' parameter. On a site where the 'publish immediately' option is enabled, the payload goes live with no moderator action and executes in the browser of every visitor who opens the injected page, enabling session/cookie theft or admin-targeted actions; on a default install the post stays Pending until an administrator approves it. No verified public exploit code was identified at time of analysis.