The vulnerability resides in the "User Submitted Posts – Enable Users to Submit Posts from the Front End" WordPress plugin. Unsanitized custom field input allows any visitor to inject JavaScript that is stored and subsequently displayed to all site users. Because the flaw is stored, the malicious code executes for every user who views the affected page, creating the potential for phishing, credential theft, defacement, or other client‑side attacks. The weakness is a classic input validation failure and corresponds to CWE‑79. The impact spans confidentiality, integrity, and availability of the affected website, depending on the payload.

WordPress sites running the User Submitted Posts – Enable Users to Submit Posts from the Front End plugin with versions up to and including 20251210 are susceptible. No other products or versions are listed as affected.

The CVSS base score of 7.2 indicates a high‑moderate severity, but the EPSS score of less than 1% suggests that public exploitation is currently unlikely. The vulnerability is not recorded in the CISA KEV catalog. Attackers can leverage the flaw via a simple unauthenticated HTTP request to the plugin’s custom‑field submission endpoint; no special privileges are required. Once the payload is stored, it will be delivered to every subsequent visitor of the affected page, making the exploitation straightforward for an attacker who can trigger the form or where user input is permitted.