CVE-2026-13253

Name of the Vulnerable Software and Affected Versions The Ultimate Post versions prior to 5.0.32

Description Stored Cross-Site Scripting occurs via the moreResultsText block attribute of the ultimate-post/advanced-search block. The issue stems from insufficient input sanitization and output escaping within the Advanced Search::content() render callback. While the attribute value is filtered using wp kses(), which removes disallowed HTML tags, it fails to escape HTML special characters like double quotes. Consequently, the result is concatenated directly into the data-viewmoretext HTML attribute without using esc attr(). This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages that execute when a user visits the affected page.

Recommendations Update The Ultimate Post to version 5.0.32 or later.