Vulnerability Bulletins |
CVE-2026-11570 |
|
| Affected software | WORDPRESS |
| The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting that can be triggered by unauthenticated users when a non-default display option is enabled. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-11570 | |