CVE-2026-119162

Name of the Vulnerable Software and Affected Versions User Submitted Posts – Enable Users to Submit Posts from the Front End versions prior to 20260917

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the user-submitted-content parameter, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. While default installations require admin approval for pending posts, enabling the publish immediately option allows the payload to become live without moderator interaction.

Recommendations Update to a version later than 20260916. Restrict the use of the user-submitted-content parameter or disable the publish immediately option to ensure all submissions undergo moderator approval.