User Submitted Posts – Enable Users to Submit Posts from the Front End

Explore User Submitted Posts – Enable Users to Submit Posts from the Front End vulnerabilities across all versions. Currently tracking 12 known vulnerabilities, including severity, impact, and patch status.

01234567891021.02.2011Today10.02.20167.2User Submitted Posts < 20160215 - Reflected Cross-Site Scripting CVSS 7.2 · 10.02.201602.05.20199.8User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload CVSS 9.8 · 02.05.201914.08.20237.2User Submitted Posts <= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content' CVSS 7.2 · 14.08.202305.09.20236.4User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20230811 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 05.09.202306.09.20236.4User Submitted Posts <= 20230901 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 06.09.202310.10.20239.8User Submitted Posts <= 20230902 - Unauthenticated Arbitrary File Upload CVSS 9.8 · 10.10.202322.06.20244.4User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20240319 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 22.06.202402.04.20254.4User Submitted Posts <= 20241026 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 02.04.202501.01.20265.3User Submitted Posts <= 20251121 - Unauthenticated Open Redirect CVSS 5.3 · 01.01.202615.01.20266.4User Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode CVSS 6.4 · 15.01.202623.01.20267.2User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field CVSS 7.2 · 23.01.202617.02.20265.3User Submitted Posts <= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter CVSS 5.3 · 17.02.2026

Strategic Overview

Avg CVSSMedium
6.6/ 10
Patch Coverage100%
Open

0

Fixed

12

Get automatic notifications for all User Submitted Posts – Enable Users to Submit Posts from the Front End vulnerabilities before they are exploited.

Vulnerability Records

12 records
2026-02-17 20:36CVE-2026-2126
5.3
Medium
type5afeYes
2026-01-23 19:55CVE-2026-0800
7.2
High
Balamurugan RYes
2026-01-15 00:00CVE-2026-0913
6.4
Medium
Muhammad Yudha - DJYes
2026-01-01 00:00CVE-2025-68509
5.3
Medium
benzdeusYes
2025-04-02 18:47CVE-2025-2874
4.4
Medium
Quang Bach (maysbachs)Yes
2024-06-22 00:00CVE-2024-5002
4.4
Medium
Guido Iván GarcíaYes
2023-10-10 00:00CVE-2023-45603
9.8
Critical
Rafie MuhammadYes
2023-09-06 00:00CVE-2023-7251
6.4
Medium
Ngô Thiên An (ancorn_)Yes
2023-09-05 00:00CVE-2023-4779
6.4
Medium
Ngô Thiên An (ancorn_)Yes
2023-08-14 00:00CVE-2023-4308
7.2
High
Ngô Thiên An (ancorn_)Yes
Showing 1–10 of 12 reports
User Submitted Posts – Enable Users to Submit Posts from the Front End banner
Latestv20260608

User Submitted Posts – Enable Users to Submit Posts from the Front End

Jeff Starr

Author

Jeff Starr

4.8(910)
96/100
Last Updated
2026-06-08 (2mo ago)
Active Installs
10,000+
Downloads
1,192,871
Requires WP
4.7+
Requires PHP
5.6.20+
Tested up to
WP 7.0.2
Created
2011-02-21 (16y ago)

🏆 The #1 Plugin for user-generated content User Submitted Posts (USP) provides a front-end form that enables visitors to submit posts and upload images. Just add the following shortcode to any Post, Page, or Widget: [user-submitted-posts] That’s all there is to it! Your site now can accept user generated content. Everything is super easy to customize via Plugin Settings page. 🚀 Enable visitors to submit posts from the front end of your site ✨ Form Fields The submission form may include any/all of the following fields: Name Email URL Post Title Post Tags Post Category Post Content Custom Field 1 Custom Field 2 Custom Checkbox Challenge Question Google reCAPTCHA (v2 or v3 Invisible) Cloudflare Turnstile (Invisible) Post Images Agree to Terms 🚀 The first and best plugin for user-submitted content ✨ Core Features Simple to set up and display the form anywhere on your site Display the form on multiple posts and pages, or even site-wide Redirect users to any URL or stay on current page after submitting posts Set post status as draft, pending, publish, or publish after x number of posts Option to receive email notifications for submitted posts Customize email notifications with various post data Include email links to edit and delete posts Display a basic login/register/password form 🚀 Enable your visitors to share their own posts and images ✨ Form Features Display form anywhere via shortcode or template tag Display only the fields that you want on the form Set each displayed form field to be required or optional Automatic client-side form validation provided by Parsley Stops spam via input validation, your choice of captcha, and hidden field Choose Google reCAPTCHA, Cloudflare Turnstile, or Challenge Question Choose Google reCAPTCHA v2 (“I am not a bot”) or v3 (Invisible) Optionally require users to be logged in to use the form 🚀 Dial in the perfect form for your visitors ✨ More Features Lightweight, fast, and secure Translated into 20+ languages Option to submit posts as WP Posts or Pages Provides option to enable a custom form and styles Customize success, error, and file upload messages Includes shortcode to display a list of submitted posts Includes shortcodes to control access and restrict content Includes template tags to display submitted post content 🚀 Simple to use, lightweight, and flexible ✨ Image Uploads Enable visitors to upload any number of images Specify minimum and maximum number of allowed images Specify minimum and maximum width and height for images Automatically set submitted images as Featured Images Automatically display submitted images on the front end Includes template tags to display submitted images Includes shortcodes to display submitted images Form displays thumbnail previews of images 🚀 The easiest way to enable user content ✨ Pro Version Pro version includes many powerful features, with unlimited custom forms, unlimited form fields, multimedia file uploads, and much more. Pro features include: Unlimited forms Unlimited form fields Unlimited file uploads All field types, including textarea, checkboxes, radio, select, file(s), plus input types like text, password, url, search, email, month, time, color, date, range, number, and more Build post-submission forms, user-registration forms, and contact forms Build COMBO forms (e.g., forms that submit posts AND register users) Supports unlimited Custom Post Types Supports custom Taxonomy fields Supports Custom Post Status Supports Post Formats Custom error messages Custom redirects Advanced security features Advanced shortcode to display submitted posts on the front end Plus everything the free version can do and more! 🚀 Visit Plugin Planet to learn more and get USP Pro &raquo; ✨ Translations User Submitted Posts supports translation into any language. Current translations include the following languages: Arabic - usp-ar Bengali - usp-bn_BD Chinese (Simplified) - usp-zh_CN Chinese (Traditional) - usp-zh_TW Czech - usp-cs_CZ Dutch - usp-nl_NL French (France) - usp-fr_FR German - usp-de_DE Greek - usp-el Hebrew - usp-he_IL Hindi - usp-hi_IN Irish - usp-ga Italian - usp-it_IT Japanese - usp-ja Korean - usp-ko_KR Norwegian - usp-no Panjabi - usp-pa_IN Persian - usp-fa_IR Polish - usp-pl_PL Portuguese (Brazil) - usp-pt_BR Portuguese (Portugal) - usp-pt_PT Romanian - usp-ro_RO Russian - usp-ru_RU Serbian - usp-sr_RS Slovenian - usp-sl_SI Spanish (Spain) - usp-es_ES Swedish - usp-sv_SE Turkish - usp-tr_TR Urdu - usp-ur Note: Most of the default translations are made via Google Translate. So they are automated and may be a little rough. Feel free to make your own translation as desired. Need a translation into your language? Let me know! ✨ Privacy User Data: This plugin enables users to submit post content. It collects data only from users who voluntarily submit content via the USP form. The only involuntary data that is collected is the IP address of the person submitting the form. The plugin provides an option to disable IP collection completely. Cookies: This plugin uses simple cookies to enable dynamic form functionality. No cookies are used for any other purpose. Services: This plugin provides an option to enable Google reCaptcha, which is provided by Google as a third-party service. For details on privacy and more, please refer to official documentation for Google reCaptcha. This plugin also provides an option to enable Cloudflare Turnstile, which is provided by Cloudflare as a third-party service. For details on privacy and more, please refer to official documentation for Cloudflare Turnstile. No other outside services or locations are accessed/used by this plugin. ✨ Developer User Submitted Posts is developed and maintained by Jeff Starr, 15-year WordPress developer and book author. ✨ Support Development I develop and maintain this free plugin with love for the WordPress community. To show support, you can make a donation or purchase one of my books: The Tao of WordPress Digging into WordPress .htaccess made easy WordPress Themes In Depth Wizard’s SQL Recipes for WordPress And/or purchase one of my premium WordPress plugins: BBQ Pro – Blazing fast WordPress firewall Blackhole Pro – Automatically block bad bots Banhammer Pro – Monitor traffic and ban the bad guys GA Google Analytics Pro – Connect WordPress to Google Analytics Head Meta Pro – Ultimate Meta Tags for WordPress REST Pro Tools – Awesome tools for managing the WP REST API Simple Ajax Chat Pro – Unlimited chat rooms USP Pro – Unlimited front-end forms Links, tweets and likes also appreciated. Thanks! 🙂

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C