The vulnerability allows an attacker to craft a URL that, when redirected by the User Submitted Posts plugin, directs site visitors to an untrusted site. This can be used to phishing attacks or to spread malware by exploiting user trust. The weakness is an open URL redirection flaw where input is not validated and can be exploited with minimal effort once embedded in a user‑submittable field.

Jeff Starr’s User Submitted Posts plugin for WordPress is impacted. All releases through and including version 20251121 contain the flaw. The issue arises when the plugin processes user‑submitted content that includes a redirect link.

The CVSS score of 4.7 indicates moderate overall severity. The EPSS score of less than 1% suggests this is not a common or actively exploited vulnerability at present, and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote; an attacker can supply malicious content via the public submission form, causing the plugin to redirect a visitor to a malicious domain. Exploitation requires that a user visits the targeted post, so it relies on social engineering rather than on privileged access or exploitation of low‑level system flaws.