CVE-2026-11570 is a stored XSS vulnerability in the User Submitted Posts WordPress plugin prior to version 20260608. The plugin fails to escape user-submitted input before rendering it in an admin-configured display template. This allows unauthenticated attackers to inject malicious scripts that execute when the crafted content is viewed, but only if a non-default display option is enabled. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Successful exploitation could lead to limited impact including low confidentiality and integrity loss due to script execution in the context of the vulnerable site. There is no impact on availability. The vulnerability requires user interaction (UI:R) and has a high attack complexity (AC:H). No privileges are required (PR:N), and the attack surface is network accessible (AV:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid enabling non-default display options that trigger the vulnerable code path. Monitoring for updates from the plugin vendor or WPScan is recommended to apply an official fix once released.