The vulnerability is a stored XSS flaw in the User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress. A flaw in the admin settings causes the plugin to store unsanitized input and subsequently output it without proper escaping. An attacker who has administrator‑level permissions and access to the plugin’s configuration can inject arbitrary JavaScript that will execute when any user visits a page containing the injected content. This could be used for phishing, session hijacking, or delivering malware to site visitors. The weakness is a classic example of input validation and output encoding failure (CWE‑79).

WordPress sites running any version of the User Submitted Posts plugin up to and including 20240319. The issue only manifests on multi‑site installations and on installations where the unfiltered_html capability is turned off. Administrators or users with equivalent permissions who modify the plugin’s settings are the primary entry point.

The CVSS score of 4.4 indicates moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Because it requires an authenticated administrator account, the attack vector is an internal threat or an attacker who has gained privileged access. The exploit would involve logging into the site, navigating to the plugin’s admin settings, and injecting malicious code that will persist in stored posts and run on every page visit by any user who views those posts.