User Submitted Posts Enable Users To Submit Posts From The Front End
Monthly
Stored DOM-based cross-site scripting in the WordPress plugin 'User Submitted Posts - Enable Users to Submit Posts from the Front End' (all versions up to and including 20260916) allows unauthenticated attackers to inject arbitrary web scripts via the 'user-submitted-content' parameter of the plugin's public front-end submission form, with the payload executing when a visitor or reviewing administrator later loads the affected page. The practical risk is governed by moderation mode: on a default installation the submission is held as Pending and an administrator must approve it before the payload is reachable, whereas enabling the non-default 'publish immediately' option removes that approval step and makes the stored payload live with no moderator interaction. No public exploit code or active exploitation is identified in the available data, and the impact is bounded to in-browser script execution in the context of the viewing user rather than server compromise; the this_week priority label reflects a real but conditional exposure rather than an emergency.
Stored DOM-based cross-site scripting in the WordPress plugin 'User Submitted Posts - Enable Users to Submit Posts from the Front End' (all versions up to and including 20260916) allows unauthenticated attackers to inject arbitrary web scripts via the 'user-submitted-content' parameter of the plugin's public front-end submission form, with the payload executing when a visitor or reviewing administrator later loads the affected page. The practical risk is governed by moderation mode: on a default installation the submission is held as Pending and an administrator must approve it before the payload is reachable, whereas enabling the non-default 'publish immediately' option removes that approval step and makes the stored payload live with no moderator interaction. No public exploit code or active exploitation is identified in the available data, and the impact is bounded to in-browser script execution in the context of the viewing user rather than server compromise; the this_week priority label reflects a real but conditional exposure rather than an emergency.