Security Alert Summary
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability affecting the plugin’s usp_access shortcode. Authenticated users with Contributor-level access and above can supply attributes that are not properly sanitized or escaped, allowing injected scripts to execute when an affected page is viewed.
CVE Details
- CVE ID: CVE-2026-0913
- Affected plugin / component: User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress
- Affected versions: All versions up to, and including, 20260110
- Published: January 16, 2026 at 9:16 AM UTC
- Last modified: January 16, 2026 at 3:55 PM UTC
- CVSS v3.1 base score / severity / vector: 6.4 / MEDIUM /
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Authentication is required; attacker needs low privileges (PR:L) consistent with Contributor-level access and above; no user interaction required (UI:N)
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting)
Technical Details
The vulnerability is a stored Cross-Site Scripting (XSS) issue that exists because the plugin does not sufficiently sanitize and escape user-supplied attributes passed to the usp_access shortcode. When a user with Contributor-level access or higher supplies malicious input in those shortcode attributes, the input can be stored and later rendered on pages without proper output escaping.
Because the unsafe data is stored and later served to other users, any script inserted via the shortcode attributes will execute in the context of a visitor’s browser when they load an injected page. The CVE description identifies insufficient input sanitization and output escaping on user-supplied attributes as the root cause; no additional functions or endpoints are named beyond the usp_access shortcode.
How This Could Impact Your Website
Consider a site where site administrators, internal staff, and external contributors collaborate. A contributor who can add or edit content using the plugin’s front-end submission features could include malicious JavaScript in shortcode attributes. When an internal staff member or a site visitor views the affected post or page, that script can run in their browser.
- An executed script could read data accessible in the browser (for example, visible profile information) and send it to an attacker-controlled server, leading to exposure of information such as user names or other visible details.
- Exposed information increases the risk of targeted phishing or social engineering against site staff or contributors.
- Because the CVSS impacts confidentiality and integrity at a low level, the likely effects are data disclosure or content manipulation limited to what the injected script can access in the victim’s browser, rather than immediate full site takeover.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Review and reduce unnecessary user roles, especially Contributor and higher privileges for external or untrusted users.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, including unexpected content changes or submissions.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
