Executive brief
The User Submitted Posts plugin for WordPress, which allows visitors to submit content to a website, contains a security flaw that allows attackers to inject malicious scripts. If a site administrator has customized how author names are displayed, an unauthenticated visitor can submit a post containing hidden code that executes when other users or administrators view the published content. This could lead to unauthorized actions being performed in the context of an administrator's session, potentially compromising the website.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the User Submitted Posts plugin due to insufficient output escaping of the '%%author%%' placeholder. When the plugin is configured with a non-default 'Name Markup' template that places the author placeholder inside an HTML attribute (e.g., a title attribute), unauthenticated users can submit a post with a malicious payload in the 'Your Name' field. Once the post is published by an administrator, the payload executes in the browser of any user viewing the post. This allows for session hijacking or unauthorized administrative actions. The issue is fixed in version 20260608.
Affected products
- Unknown User Submitted Posts < 20260608
Timeline
- 2026-06-08: patched: Vulnerability fixed in version 20260608
- 2026-06-10: disclosed: Public disclosure via WPScan
- 2026-07-01: advisory: NVD publication date