User Submitted Posts EUVD-2026-89958

Requires a WordPress site running the User Submitted Posts plugin (versions up to and including 20260810) and an attacker holding at least a low-privileged authenticated account or access to the plugin's user-submission workflow (PR:L). The stored payload only triggers when a victim - typically an administrator or editor reviewing the submitted post - loads the affected page (UI:R), so exploitation depends on that human interaction rather than firing automatically. It is not exploitable unauthenticated against a default install without a submission path, and the specific vulnerable submission field is not identified in the available data.

This is a classic WordPress-plugin stored XSS scored at CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) by Patchstack. The vector is network-reachable and low-complexity, but it is NOT unauthenticated: PR:L requires at least a low-privileged authenticated account, and UI:R means a victim (typically an admin/editor reviewing submitted content) must load the page for the payload to fire. The scope change (S:C) reflects script executing in the site's browser origin/admin context rather than the plugin's own boundary, and impact is uniformly Low across C/I/A rather than any single high impact - consistent with injected script rather than direct data theft or RCE. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis'. There is no SSVC decision data provided. Net: this is a real-but-modest issue - a genuine stored XSS worth patching on exposed multi-author or public-submission sites, but not an urgent internet-wide emergency. The signals are internally consistent (medium CVSS, no active-exploitation evidence, requires auth + interaction), so it reads as a routine hygiene patch rather than a high-priority incident.

On a site running User Submitted Posts, a low-privileged authenticated user (or a permitted submitter) enters a crafted post field containing a malicious script payload that is stored without proper neutralization. When an administrator or editor later views the submitted post in the dashboard or on a rendering page, the script executes in their authenticated browser session. No public proof-of-concept is referenced in the available data.