User Submitted Posts: known security problems
15 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.
Updated
In short
There are 15 known security problems on this page. Each one has a fixed version. Updating to version 20261029 or newer covers every fixed problem listed here.
Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.
Get an email when your site is affected: install Watchfox AI (free)
A stranger could plant harmful code that runs for your visitors or admins (up to and including 20260916)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 20260916
- Fixed in
- 20261029
- What to do
- If your site has an affected version, update User Submitted Posts to version 20261029 or newer.
- Official ID
- CVE-2026-119162
- Report title
- User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting
- First reported
- Sources
- Wordfence, seen
Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 20260810)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 20260810
- Fixed in
- 20260916
- What to do
- If your site has an affected version, update User Submitted Posts to version 20260916 or newer.
- Official ID
- CVE-2026-62084
- Report title
- User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20260810 - Authenticated (Contributor+) Stored Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
A stranger could plant harmful code that runs for your visitors or admins (up to and including 20260607)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 20260607
- Fixed in
- 20260608
- What to do
- If your site has an affected version, update User Submitted Posts to version 20260608 or newer.
- Official ID
- CVE-2026-11570
- Report title
- User Submitted Posts <= 20260607 - Unauthenticated Stored Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
A stranger could use it to harm your site
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 20260113
- Fixed in
- 20260217
- What to do
- If your site has an affected version, update User Submitted Posts to version 20260217 or newer.
- Official ID
- CVE-2026-2126
- Report title
- User Submitted Posts <= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter
- First reported
- Sources
- Wordfence, seen
A stranger could plant harmful code that runs for your visitors or admins (up to and including 20251210)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 20251210
- Fixed in
- 20260110
- What to do
- If your site has an affected version, update User Submitted Posts to version 20260110 or newer.
- Official ID
- CVE-2026-0800
- Report title
- User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field
- First reported
- Sources
- Wordfence, seen
Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 20260110)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 20260110
- Fixed in
- 20260113
- What to do
- If your site has an affected version, update User Submitted Posts to version 20260113 or newer.
- Official ID
- CVE-2026-0913
- Report title
- User Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode
- First reported
- Sources
- Wordfence, seen
A stranger could send your visitors from your site to a harmful site
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 20251121
- Fixed in
- 20251210
- What to do
- If your site has an affected version, update User Submitted Posts to version 20251210 or newer.
- Official ID
- CVE-2025-68509
- Report title
- User Submitted Posts <= 20251121 - Unauthenticated Open Redirect
- First reported
- Sources
- Wordfence, seen
Someone could plant harmful code that runs for your visitors or admins (up to and including 20241026)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 20241026
- Fixed in
- 20250327
- What to do
- If your site has an affected version, update User Submitted Posts to version 20250327 or newer.
- Official ID
- CVE-2025-2874
- Report title
- User Submitted Posts <= 20241026 - Authenticated (Admin+) Stored Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
Someone could plant harmful code that runs for your visitors or admins (up to and including 20240319)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 20240319
- Fixed in
- 20240516
- What to do
- If your site has an affected version, update User Submitted Posts to version 20240516 or newer.
- Official ID
- CVE-2024-5002
- Report title
- User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20240319 - Authenticated (Admin+) Stored Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
A stranger could run their own code on your site and take it over (up to and including 20230902)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 20230902
- Fixed in
- 20230914
- What to do
- If your site has an affected version, update User Submitted Posts to version 20230914 or newer.
- Official ID
- CVE-2023-45603
- Report title
- User Submitted Posts <= 20230902 - Unauthenticated Arbitrary File Upload
- First reported
- Sources
- Wordfence, seen
Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 20230901)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 20230901
- Fixed in
- 20230902
- What to do
- If your site has an affected version, update User Submitted Posts to version 20230902 or newer.
- Official ID
- CVE-2023-7251
- Report title
- User Submitted Posts <= 20230901 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- First reported
- Sources
- Wordfence, seen
Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 20230811)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 20230811
- Fixed in
- 20230901
- What to do
- If your site has an affected version, update User Submitted Posts to version 20230901 or newer.
- Official ID
- CVE-2023-4779
- Report title
- User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20230811 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- First reported
- Sources
- Wordfence, seen
A stranger could plant harmful code that runs for your visitors or admins (up to and including 20230809)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 20230809
- Fixed in
- 20230811
- What to do
- If your site has an affected version, update User Submitted Posts to version 20230811 or newer.
- Official ID
- CVE-2023-4308
- Report title
- User Submitted Posts <= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content'
- First reported
- Sources
- Wordfence, seen
A stranger could run their own code on your site and take it over (before 20190426)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Before 20190426
- Fixed in
- 20190426
- What to do
- If your site has an affected version, update User Submitted Posts to version 20190426 or newer.
- Official ID
- CVE-2019-25138
- Report title
- User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload
- First reported
- Sources
- Wordfence, seen
Someone could plant harmful code that runs for your visitors or admins (before 20160215)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Before 20160215
- Fixed in
- 20160215
- What to do
- If your site has an affected version, update User Submitted Posts to version 20160215 or newer.
- Official ID
- CVE-2016-11001
- Report title
- User Submitted Posts < 20160215 - Reflected Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
Where this comes from
We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.
Get an email when your site is affected.
Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.
Install Watchfox AI (free)