CVE-2026-11570 describes a stored XSS vulnerability in the User Submitted Posts WordPress plugin prior to version 20260608. The plugin fails to escape user-submitted input before rendering it in an admin-configured display template. This flaw allows unauthenticated attackers to inject malicious scripts that execute in the context of the admin interface, but only when a non-default display option is enabled. The vulnerability has a CVSS 3.1 base score of 4.2, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, and requiring user interaction. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the WordPress admin interface, potentially leading to limited confidentiality and integrity impacts. The vulnerability does not affect availability. Because the attack requires user interaction and a specific display configuration, the risk is somewhat constrained.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid enabling non-default display options that render user-submitted content or apply manual input sanitization and escaping in display templates to mitigate the risk.