Stored Cross-Site Scripting in User Submitted Posts Plugin for WordPress

CVE-2025-2874

Summary

The User Submitted Posts plugin for WordPress, in all versions up to and including 20240319, suffers from a critical vulnerability that allows for Stored Cross-Site Scripting. This issue arises from inadequate input sanitization and output escaping in admin settings, which enables authenticated attackers with administrator-level permissions or higher to inject malicious web scripts. These scripts can execute whenever users access pages affected by the injection. It is particularly concerning for multi-site installations and environments where unfiltered_html is disabled, emphasizing the need for immediate awareness and remediation.

References