The vulnerability allows an unauthenticated user to insert malicious script code into the author name field of a WordPress post submission form. Because the plugin outputs the field value without escaping in a custom admin‑configured display template, the script is stored in the database. When any user views the page that renders the sanitized post, the injected code executes in their browser, enabling attacks such as cookie theft, session hijacking, def additional malware. The impact is confined to the the entire user base that accesses the affected content.

WordPress installations using the User Submitted Posts plugin prior to the release dated 20260608 are affected. No other vendors or products are listed in the CNA data. The flaw exists in all pre‑20260608 versions regardless of other installed plugins or themes.

No CVSS or EPSS scores are published for this entry, and it is not yet listed in the CISA KEV catalog. The threat can be leveraged by any unauthenticated user who can trigger the non‑default display option. While the vulnerability does not provide immediate remote code execution on the server, the stored XSS payload is persistent and widely distributed once the malicious author name is rendered, making the risk moderate but potentially high if the injected script performs destructive actions on user browsers.