Stored XSS via Unescaped Author Name in User Submitted Posts WordPress Plugin

CVE-2026-11570 is a stored cross-site scripting (XSS) flaw in the User Submitted Posts WordPress plugin, versions prior to 20260608. The plugin lets unauthenticated visitors submit posts via a front-end form. The author-name field is stored in the database without escaping and later rendered raw inside an admin-configured display template. An attacker submits a post with a crafted <script> payload in the author name; when any user — including a site admin — views the page where that post is displayed, the script fires in their browser session. The catch: the vulnerable rendering path is only active when a non-default display option is enabled in the plugin's settings, and the plugin itself is installed on roughly 10,000 WordPress sites worldwide.

The vendor's MEDIUM / 4.2 score is already conservative, and in practice it's still generous. The CVSS vector correctly captures High attack complexity (AC:H) and the need for user interaction (UI:R), but it doesn't price in the vanishingly small install base or the non-default configuration gate. No exploitation has been observed in the wild, no proof-of-concept code is publicly circulating, EPSS sits at 0.22% (bottom quartile), and CISA has not added this to the KEV catalog. For a 10,000-host enterprise fleet, the probability that *any* host runs this plugin *and* has the non-default option enabled is near zero. This is backlog hygiene, not a fire drill.

Sources.

1. OpenCVE — CVE-2026-11570 Detail
2. CyberStrike — CVE-2026-11570 Analysis
3. BitNinja — CVE-2026-11570 Advisory
4. WordPress.org — User Submitted Posts Plugin Page
5. Patchstack — User Submitted Posts Vulnerability History
6. Infosecurity Magazine — User Submitted Posts Vulnerability Coverage

Run this script on the WordPress server (or any host with filesystem access to the WordPress installation directory) as a user with read access to the plugin directory. Invoke with: bash check_cve_2026_11570.sh /var/www/html (pass the WordPress root path as the first argument). No elevated privileges required — just read access to wp-content/plugins/.

#!/usr/bin/env bash
# check_cve_2026_11570.sh — Detect CVE-2026-11570 in User Submitted Posts plugin
# Usage: bash check_cve_2026_11570.sh /path/to/wordpress
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

WP_ROOT="${1:?Usage: $0 /path/to/wordpress}"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/user-submitted-posts"
README="$PLUGIN_DIR/readme.txt"
MAIN_PHP="$PLUGIN_DIR/user-submitted-posts.php"
FIXED_VERSION=20260608

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "UNKNOWN — User Submitted Posts plugin is not installed at $PLUGIN_DIR"
  exit 2
fi

# Try to extract version from main PHP file header
VERSION=""
if [ -f "$MAIN_PHP" ]; then
  VERSION=$(grep -i '^[[:space:]]*\*[[:space:]]*Version:' "$MAIN_PHP" | head -1 | sed 's/.*Version:[[:space:]]*//' | tr -d '[:space:]')
fi

# Fallback: try readme.txt Stable tag
if [ -z "$VERSION" ] && [ -f "$README" ]; then
  VERSION=$(grep -i '^Stable tag:' "$README" | head -1 | sed 's/.*Stable tag:[[:space:]]*//' | tr -d '[:space:]')
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not determine plugin version from $PLUGIN_DIR"
  exit 2
fi

echo "Detected User Submitted Posts version: $VERSION"

# Compare as integers (plugin uses YYYYMMDD versioning)
if [[ "$VERSION" =~ ^[0-9]+$ ]]; then
  if [ "$VERSION" -ge "$FIXED_VERSION" ]; then
    echo "PATCHED — Version $VERSION >= $FIXED_VERSION (CVE-2026-11570 fix)"
    exit 0
  else
    echo "VULNERABLE — Version $VERSION < $FIXED_VERSION (CVE-2026-11570 applies)"
    exit 1
  fi
else
  echo "UNKNOWN — Version string '$VERSION' is not in expected YYYYMMDD format"
  exit 2
fi