User Submitted Posts < 20260608 – Unauthenticated Stored XSS via Author Name | CVE 2026-11570

Description

The plugin does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting that can be triggered by unauthenticated users when a non-default display option is enabled.

Proof of Concept

### Prerequisites

1. The plugin is active, with a page or post that contains the `[user-submitted-posts]` shortcode.
2. Under Settings > Submitted Posts > Front-end Display, the "Name Display" option is enabled (set to Before or After content), and the "Name Markup" template places the `%%author%%` placeholder inside an HTML attribute, for example:
   `<p class="usp-author" title="%%author%%">Submitted by: %%author%%</p>`

(With the default Name Markup template `<p>%%author%%</p>` the placeholder is in a text context and the payload below does not execute. Placing `%%author%%` inside an attribute is the non-default configuration required to reach the issue.)

### Steps

1. As an unauthenticated visitor, open the page containing the submission form.
2. In the "Your Name" field, enter the following payload:
   `test" onmouseover="alert(document.domain)" x="`
3. Fill in the Title and Content fields and submit the form.
4. An administrator moderates and publishes the submitted post (normal editorial workflow).
5. Open the published post on the front end. The submitted name is injected into the attribute without escaping:
   ```html
   <p class="usp-author" title="test" onmouseover="alert(document.domain)" x="">Submitted by: ...</p>
   ```
6. Hovering over the author element executes the injected JavaScript (`alert(document.domain)`). The payload runs in the session of any visitor who views the post, including logged-in administrators.