CVE-2026-0800

🗓️ 24 Jan 2026 08:26:32Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 6 Views

Unauthenticated stored XSS in User Submitted Posts plugin via custom fields up to version 20251210.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-0800	24 Jan 202608:26	–	attackerkb
Circl	CVE-2026-0800	24 Jan 202610:44	–	circl
CNNVD	WordPress plugin User Submitted Posts cross-site scripting vulnerability	24 Jan 202600:00	–	cnnvd
Cvelist	CVE-2026-0800 User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field	24 Jan 202608:26	–	cvelist
EUVD	EUVD-2026-4549	24 Jan 202608:26	–	euvd
NVD	CVE-2026-0800	24 Jan 202609:15	–	nvd
Patchstack	WordPress User Submitted Posts - Enable Users to Submit Posts from the Front End plugin <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field vulnerability	26 Jan 202607:09	–	patchstack
Positive Technologies	PT-2026-4595	24 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-0800	25 Jan 202609:16	–	redhatcve
Vulnrichment	CVE-2026-0800 User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field	24 Jan 202608:26	–	vulnrichment

Vulners

Node

specialk user_submitted_posts_enable_users_to_submit_posts_from_the_front_endRange≤20251210wordpress

[
  {
    "vendor": "specialk",
    "product": "User Submitted Posts – Enable Users to Submit Posts from the Front End",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "20251210",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/1ec907bc-bd10-4dc5-be35-4f2aaf5ef444
plugins	www.plugins.trac.wordpress.org/changeset/3436859/user-submitted-posts

15 Apr 2026 00:35Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.2

EPSS0.00212

SSVC

CWE-79