Cross-Site Scripting
8 records66.7%First: 2016. Latest: 2026.
Plugin security history
User Submitted Posts – Enable Users to Submit Posts from the Front End Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 12 vulnerability records associated with User Submitted Posts – Enable Users to Submit Posts from the Front End, published between 2016 and 2026.
Dataset last synchronized: 2026-08-02 09:41:47 UTC
At a glance
Security Snapshot
12Total records
2Critical
3High
7Medium
0Low
0Informational
12Patched records
0Currently marked unpatched
2016-02-10First disclosure
2026-02-17Latest disclosure
12 of 12CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2016 | 1 | |
| 2019 | 1 | |
| 2023 | 4 | |
| 2024 | 1 | |
| 2025 | 1 | |
| 2026 | 4 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 2 | 16.7% |
| High | 3 | 25% |
| Medium | 7 | 58.3% |
Vulnerability-Type Breakdown
Arbitrary File Upload
2 records16.7%First: 2019. Latest: 2023.
Other
1 record8.3%First: 2026. Latest: 2026.
Missing Authorization
1 record8.3%First: 2026. Latest: 2026.
Patch Status
- Patched
- 12
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
202602172026011020260113202512102025032720240516202309142023090220230901202308112019042620160215
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-20260113 | User Submitted Posts <= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter | February 17, 2026 | 20260217 | Medium |
*-20251210 | User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field | January 23, 2026 | 20260110 | High |
*-20260110 | User Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode | January 15, 2026 | 20260113 | Medium |
*-20251121 | User Submitted Posts <= 20251121 - Unauthenticated Open Redirect | January 1, 2026 | 20251210 | Medium |
*-20241026 | User Submitted Posts <= 20241026 - Authenticated (Admin+) Stored Cross-Site Scripting | April 2, 2025 | 20250327 | Medium |
*-20240319 | User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20240319 - Authenticated (Admin+) Stored Cross-Site Scripting | June 22, 2024 | 20240516 | Medium |
*-20230902 | User Submitted Posts <= 20230902 - Unauthenticated Arbitrary File Upload | October 10, 2023 | 20230914 | Critical |
*-20230901 | User Submitted Posts <= 20230901 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | September 6, 2023 | 20230902 | Medium |
*-20230811 | User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20230811 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | September 5, 2023 | 20230901 | Medium |
*-20230809 | User Submitted Posts <= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content' | August 14, 2023 | 20230811 | High |
[*, 20190426) | User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload | May 2, 2019 | 20190426 | Critical |
[*, 20160215) | User Submitted Posts < 20160215 - Reflected Cross-Site Scripting | February 10, 2016 | 20160215 | High |
Selected source records
Latest Records
MediumCVE-2026-2126
User Submitted Posts <= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter
Published: February 17, 2026
- Affected versions
- *-20260113
- Patched versions
- 20260217
HighCVE-2026-0800
User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field
Published: January 23, 2026
- Affected versions
- *-20251210
- Patched versions
- 20260110
MediumCVE-2026-0913
User Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode
Published: January 15, 2026
- Affected versions
- *-20260110
- Patched versions
- 20260113
MediumCVE-2025-68509
User Submitted Posts <= 20251121 - Unauthenticated Open Redirect
Published: January 1, 2026
- Affected versions
- *-20251121
- Patched versions
- 20251210
MediumCVE-2025-2874
User Submitted Posts <= 20241026 - Authenticated (Admin+) Stored Cross-Site Scripting
Published: April 2, 2025
- Affected versions
- *-20241026
- Patched versions
- 20250327
MediumCVE-2024-5002
User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20240319 - Authenticated (Admin+) Stored Cross-Site Scripting
Published: June 22, 2024
- Affected versions
- *-20240319
- Patched versions
- 20240516
CriticalCVE-2023-45603
User Submitted Posts <= 20230902 - Unauthenticated Arbitrary File Upload
Published: October 10, 2023
- Affected versions
- *-20230902
- Patched versions
- 20230914
MediumCVE-2023-7251
User Submitted Posts <= 20230901 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published: September 6, 2023
- Affected versions
- *-20230901
- Patched versions
- 20230902
Highest-Severity Records
CriticalCVE-2019-25138
User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload
Published: May 2, 2019
- Affected versions
- [*, 20190426)
- Patched versions
- 20190426
CriticalCVE-2023-45603
User Submitted Posts <= 20230902 - Unauthenticated Arbitrary File Upload
Published: October 10, 2023
- Affected versions
- *-20230902
- Patched versions
- 20230914
HighCVE-2026-0800
User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field
Published: January 23, 2026
- Affected versions
- *-20251210
- Patched versions
- 20260110
HighCVE-2023-4308
User Submitted Posts <= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content'
Published: August 14, 2023
- Affected versions
- *-20230809
- Patched versions
- 20230811
HighCVE-2016-11001
User Submitted Posts < 20160215 - Reflected Cross-Site Scripting
Published: February 10, 2016
- Affected versions
- [*, 20160215)
- Patched versions
- 20160215
MediumCVE-2026-0913
User Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode
Published: January 15, 2026
- Affected versions
- *-20260110
- Patched versions
- 20260113
MediumCVE-2023-7251
User Submitted Posts <= 20230901 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published: September 6, 2023
- Affected versions
- *-20230901
- Patched versions
- 20230902
MediumCVE-2023-4779
User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20230811 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published: September 5, 2023
- Affected versions
- *-20230811
- Patched versions
- 20230901
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.