HomeWordPress vulnerabilitiesUser Submitted Posts
User Submitted Posts vulnerabilities
User Submitted Posts has 10 known vulnerabilities in this database. The most recent published record is dated 1 Jul 2026.
- Known vulnerabilities
- 10
- Active installs
- 10,000+
- Latest version
- 20260916
- Last updated
- 16 Sep 2026
- Most recent
- 1 Jul 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Cross-site scripting (XSS) CVE-2026-11570 | Medium 4.2 | Before 20260608 | Fixed in 20260608 | 1 Jul 2026 |
| Broken access control CVE-2026-2126 | Medium 5.3 | Up to 20260113 | Fixed in a later version (latest 20260916) | 18 Feb 2026 |
| Cross-site scripting (XSS) CVE-2026-0800 | High 7.2 | Up to 20251210 | Fixed in a later version (latest 20260916) | 24 Jan 2026 |
| Cross-site scripting (XSS) CVE-2026-0913 | Medium 6.4 | Up to 20260110 | Fixed in a later version (latest 20260916) | 16 Jan 2026 |
| Cross-site scripting (XSS) CVE-2025-2874 | Medium 4.4 | Up to 20240319 | Fixed in a later version (latest 20260916) | 3 Apr 2025 |
| Cross-site scripting (XSS) CVE-2024-5002 | Medium 4.8 | Before 20240516 | Fixed in 20240516 | 13 Jul 2024 |
| Cross-site scripting (XSS) CVE-2023-4779 | Medium 6.4 | Up to 20230811 | Fixed in a later version (latest 20260916) | 6 Sep 2023 |
| Cross-site scripting (XSS) CVE-2023-4308 | High 7.2 | Before 20230811 | Fixed in 20230811 | 15 Aug 2023 |
| Remote code execution CVE-2019-25138 | Critical 9.8 | Up to 20190312 | Fixed in a later version (latest 20260916) | 7 Jun 2023 |
| Cross-site scripting (XSS) CVE-2016-11001 | Medium 6.1 | Before 20160215 | Fixed in 20160215 | 20 Sep 2019 |
Read the published descriptions
- CVE-2026-11570, 1 Jul 2026
- The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting that can be triggered by unauthenticated users when a non-default display option is enabled. CVE record
- CVE-2026-2126, 18 Feb 2026
- The User Submitted Posts - Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 20260113. This is due to the `usp_get_submitted_category()` function accepting user-submitted category IDs from the POST body without validating them against the admin-configured allowed categories stored in `usp_options['categories']`. This makes it possible for unauthenticated attackers to assign submitted posts to arbitrary categories, including restricted ones, by crafting a direct POST request with manipulated `user-submitted-category[]` values, bypassing the frontend category restrictions. CVE record
- CVE-2026-0800, 24 Jan 2026
- The User Submitted Posts - Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom fields in all versions up to, and including, 20251210 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2026-0913, 16 Jan 2026
- The User Submitted Posts - Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'usp_access' shortcode in all versions up to, and including, 20260110 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2025-2874, 3 Apr 2025
- The User Submitted Posts - Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20240319 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. CVE record
- CVE-2024-5002, 13 Jul 2024
- The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) CVE record
- CVE-2023-4779, 6 Sep 2023
- The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [usp_gallery] shortcode in versions up to, and including, 20230811 due to insufficient input sanitization and output escaping on user supplied attributes like 'before'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2023-4308, 15 Aug 2023
- The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up to, and including, 20230809 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2019-25138, 7 Jun 2023
- The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_images function in versions up to, and including, 20190312. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. CVE record
- CVE-2016-11001, 20 Sep 2019
- The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field. CVE record
What to do if you run User Submitted Posts
If you run User Submitted Posts, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new User Submitted Posts vulnerabilities
Free. We email you when a new vulnerability is published for User Submitted Posts, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.