The vulnerability is a stored DOM‑based cross‑site scripting flaw caused by the plugin's failure to properly sanitize and escape the 'user‑submitted‑content' parameter. An unauthenticated attacker can embed arbitrary JavaScript that will run whenever a user visits a page containing the submitted post. This allows for session hijacking, defacement, or execution of malicious code in the context of the site.

The issue affects the 'User Submitted Posts' plugin for WordPress, manufactured by specialk, in all releases up to and including 20260916. No other vendors are listed.

The CVSS score of 7.2 classifies this as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attack requires unauthenticated access to the front‑end submission form and the 'publish immediately' setting must be enabled to expose the stored payload without administrative moderation. Once a payload is live, any user who views the content will execute the injected script. The absence of a formal KEV listing and the lack of a low EPSS suggest that exploitation is possible but may not be widespread or actively leveraged yet.