Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

User Submitted Posts plugin can let attackers run scripts

CVE-2026-119162 · published 4 days ago
Summary

The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress lets anyone add content without properly cleaning it. As a result, an attacker can insert malicious code that will run in the browsers of anyone who views the posted page, especially if the plugin is set to publish posts automatically. Update the plugin to the latest version, turn off automatic publishing, and consider adding a web‑application firewall or other input‑filtering measures.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
specialk user submitted posts – enable users to submit posts from the front end <= 20260916
Original advisory text
User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'user-submitted-content' parameter in all versions up to, and including, 20260916 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On a default installation the submitted post is held as Pending and requires admin approval before the payload is reachable by other visitors; however, if the plugin's "publish immediately" option is enabled, no approval step exists and the stored payload becomes live without any moderator interaction.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published31 Oct 2026
Updated2 Nov 2026
First seen31 Oct 2026
Sources
CVE-2026-119162 · NVD
CVE-2026-119162 · MITRE
Track software like this
Free during beta