Threats tagged 'ghsa-3mxh-mc2j-6w4v'

The User Submitted Posts WordPress plugin is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'user-submitted-content' parameter in all versions up to and including 20260916. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. By default, submitted posts require admin approval before becoming visible, limiting exposure. However, if the plugin's 'publish immediately' option is enabled, injected scripts become live without moderation.