CVE-2026-11570

MEDIUM

User Submitted Posts < 20260608 - Unauthenticated Stored XSS via Author Name

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-11570. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-11570, a stored XSS vulnerability in the User Submitted Posts WordPress plugin (versions before 20260608). The code includes placeholder methods for checking target connectivity but lacks actual exploit implementation.

Description

The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting that can be triggered by unauthenticated users when a non-default display option is enabled.

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-11570_the_user_submitted.py

This repository contains an auto-generated stub module for CVE-2026-11570, a stored XSS vulnerability in the User Submitted Posts WordPress plugin (versions before 20260608). The code includes placeholder methods for checking target connectivity but lacks actual exploit implementation.

Classification
Stub 99%
Attack Type
Xss
Complexity
Moderate
Reliability
Theoretical
Target: User Submitted Posts WordPress plugin before 20260608
No auth needed
Prerequisites: WordPress site with vulnerable User Submitted Posts plugin installed · Ability to submit posts/content to the target site
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit exploit vdb-entry technical-description
https://wpscan.com/vulnerability/35c33c56-5b12-4be5-9d45-68f47cd854ec/

Scores

CVSS v3 4.2
EPSS 0.0014
EPSS Percentile 3.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

Status published
Products (1)
None/User Submitted Posts < 20260608
Published Jul 01, 2026
Tracked Since Jul 01, 2026