CVE-2026-96649

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink) in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site operator to have enabled guest post submission via the [fpsm] shortcode, which registers a publicly accessible AJAX handler gated only by a nonce emitted on every page containing the shortcode.

• CWE-79

• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/assets/js/fpsml-fileuploader.js#L578
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/assets/js/fpsml-fileuploader.js#L583
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/assets/js/fpsml-frontend.js#L40
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/includes/classes/class-fpsml-library.php#L112
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/includes/cores/ajax-process-form.php#L161
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/includes/cores/ajax-process-form.php#L5
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.5/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0af8ff06-68e2-4a0c-9de4-d06a6a2e86c9?source=cve

Published

Sep 30, 2026

Last Modified

Sep 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96609Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limi…7.1
• CVE-2026-96611FFmpeg before 9.0 has a signed integer overflow in libavform…6.9
• CVE-2026-96613The Meari IoT Cloud Platform OpenAPI Service is vulnerable t…6.5
• CVE-2026-9662The Recover Exit For WooCommerce plugin for WordPress is vul…8.1
• CVE-2026-96647The Listdom: AI-powered Business Directory with Classifieds …6.4
• CVE-2026-96648The Data Tables Generator by Supsystic plugin for WordPress …6.4
• CVE-2026-96650The Strong Testimonials plugin for WordPress is vulnerable t…7.2
• CVE-2026-96651Plex Media Server before 1.43.3.10861 builds a file path fro…6.5
• CVE-2026-96652Plex Media Server before 1.43.3.10861 allows SSRF via '/play…4.3
• CVE-2026-96653The WP Directory Kit plugin for WordPress is vulnerable to t…6.5
• CVE-2026-96654Plex Media Server before 1.43.3.10861 does not correctly neu…6.5
• CVE-2026-96655Plex Media Server before 1.43.3.10861 allows an authenticate…4.3