The 'User Submitted Posts – Enable Users to Submit Posts from the Front End' WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject arbitrary scripts via the plugin's admin settings, which execute when users access the affected pages. This vulnerability affects multi-site installations or those with unfiltered_html disabled and exists in all versions up to 20240319. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges without user interaction. No patch or remediation details are currently provided by the vendor.

An authenticated attacker with administrator-level permissions can inject malicious scripts that execute in the context of users visiting the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or defacement, but does not affect availability. The vulnerability is limited to multi-site WordPress installations or those with unfiltered_html disabled. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or removing the vulnerable plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once available.