CVE-2026-11570: Unknown User Submitted Posts

Medium severity, CVSS 4.2. EPSS: 0.2% chance of exploitation in the next 30 days.

The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting that can be triggered by unauthenticated users when a non-default display option is enabled.

Affected products

• Unknown User Submitted Posts: before 20260608 (fixed in 20260608)

Published 2026-07-01. Last modified 2026-07-01.