AUGUST 23, 2026
Live Feed
Back to database
Case File

CVE-2026-11570

MEDIUM · CVSS 4.2 EPSS 0.14%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-07-01 · Last synced 2026-08-04

CyberRota Analysis

This is a medium severity vulnerability with a CVSS score of 4.2. It affects WordPress. Exploitation may require the attacker to be authenticated.

CVE
CVE-2026-11570
Severity
MEDIUM
CVSS
4.2
EPSS
0.14%
WordPress

Original NVD Description

The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting that can be triggered by unauthenticated users when a non-default display option is enabled.