CVE-2026-0913

Name of the Vulnerable Software and Affected Versions User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress versions prior to 20260111

Description The software is susceptible to Stored Cross-Site Scripting through the 'usp access' shortcode due to inadequate input sanitization and output escaping of user-provided attributes. This allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. These scripts will then execute whenever a user accesses the compromised page.

Recommendations Update the User Submitted Posts – Enable Users to Submit Posts from the Front End plugin to version 20260111 or later.