Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: specialk Component: User Submitted Posts Clear all filters
TI-2024-04645 CVE-2024-5002 · GHSA-ggxx-7xgm-c5m6

User Submitted Posts < 20240516 - Admin+ Stored XSS

Priority MEDIUM 55

The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when t…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00423 Published 2024-07-13 Fixed in 20240516 CWE-79
TI-2023-24406 CVE-2023-45603 · GHSA-4v55-6j3q-q3g7

WordPress User Submitted Posts Plugin <= 20230902 is vulnerable to Arbitrary File Upload

Priority MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in Jeff Starr User Submitted Posts – Enable Users to Submit Posts from the Front End.This issue affects User Submitted Posts – Enable Users to Submit Posts fr…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00975 Published 2023-12-20 No fix listed CWE-434
TI-2023-04406 CVE-2023-4779 · GHSA-3c82-f6j3-5x2g

Cross-site scripting in specialk User Submitted Posts – Enable Users to Submit Posts from…

Priority LOW 29

The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [usp_gallery] shortcode in versions up to, and including, 20230811 due to insufficient input sanitization and ou…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00384 Published 2023-09-06 No fix listed CWE-79
TI-2023-03982 CVE-2023-4308 · GHSA-cxw2-5qm7-6j42

User Submitted Posts <= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content'

Priority LOW 38

The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up to, and including, 20230809 due to insufficient input sanitization and…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0042 Published 2023-08-15 No fix listed CWE-79
TI-2019-15241 CVE-2019-25138 · GHSA-wrjq-6j55-j564

User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload

Priority MEDIUM 53

The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_images function in versions up to, and including, 20190312.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02326 Published 2023-06-07 Fixed in 20190426 CWE-434