https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T23:54:37.902466+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-281363 EUVD-2026-281363 2026-10-06T23:54:37.904624+00:00 EUVD-2026-281363 https://cve.radiocsirt.org/vuln/fkie_cve-2026-2126 fkie_cve-2026-2126 2026-10-06T23:54:37.904657+00:00

The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 20260113. This is due to the `usp_get_submitted_category()` function accepting user-submitted category IDs from the POST body without validating them against the admin-configured allowed categories stored in `usp_options['categories']`. This makes it possible for unauthenticated attackers to assign submitted posts to arbitrary categories, including restricted ones, by crafting a direct POST request with manipulated `user-submitted-category[]` values, bypassing the frontend category restrictions.

 https://cve.radiocsirt.org/vuln/ghsa-pm8v-w3f2-2hxx GHSA-pm8v-w3f2-2hxx 2026-10-06T23:54:37.904694+00:00

The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 20260113. This is due to the `usp_get_submitted_category()` function accepting user-submitted category IDs from the POST body without validating them against the admin-configured allowed categories stored in `usp_options['categories']`. This makes it possible for unauthenticated attackers to assign submitted posts to arbitrary categories, including restricted ones, by crafting a direct POST request with manipulated `user-submitted-category[]` values, bypassing the frontend category restrictions.