CVE-2026-0800 is a stored cross-site scripting vulnerability (CWE-79) in the WordPress plugin 'User Submitted Posts – Enable Users to Submit Posts from the Front End' by specialk. The flaw exists due to improper neutralization of input in custom fields, allowing unauthenticated attackers to inject arbitrary web scripts that execute when the injected page is accessed. This affects all versions up to 20251210. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity. No patch or remediation details are currently available from the vendor or other sources.

Successful exploitation allows unauthenticated attackers to inject and store malicious scripts in user-submitted posts, which execute in the context of other users viewing the affected pages. This can lead to theft of sensitive information, session hijacking, or other client-side attacks impacting confidentiality and integrity. There is no reported impact on availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting the use of the affected plugin to prevent exploitation. Avoid allowing untrusted users to submit posts with custom fields. Monitor official vendor channels for updates regarding patches or mitigations.