CVE-2026-96649
Received Received - Intake

Stored DOM-Based XSS in Frontend Post Submission Manager Lite WordPress Plugin

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Wordfence

Description
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink) in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site operator to have enabled guest post submission via the [fpsm] shortcode, which registers a publicly accessible AJAX handler gated only by a nonce emitted on every page containing the shortcode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-96649
EUVD
EUVD-2026-89577

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frontend_post_submission_manager_lite frontend_posting_wordpress_plugin to 1.3.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability in the Frontend Post Submission Manager Lite WordPress plugin. It allows unauthenticated attackers to inject malicious scripts via the post_content parameter due to insufficient input sanitization and output escaping. The scripts execute when users access an infected page, but only if the site operator enabled guest post submission via the [fpsm] shortcode.

Detection Guidance

Check if the Frontend Post Submission Manager Lite plugin is installed and enabled. Look for the [fpsm] shortcode in pages or posts. Inspect network traffic for AJAX requests to gpsm_guest_post_submit with unsanitized post_content parameters.

Impact Analysis

Unauthenticated attackers could inject malicious scripts into your website, potentially stealing user data, session cookies, or performing actions on behalf of users. This could lead to unauthorized access, defacement, or spreading malware to visitors. The impact depends on the privileges of users visiting the compromised pages.

Compliance Impact

This vulnerability could lead to data breaches, exposing user data and violating GDPR or HIPAA requirements for data protection. Organizations may face fines, legal action, or reputational damage if user data is compromised due to this flaw.

Mitigation Strategies

Update the plugin to the latest version if available. Disable guest post submission via the [fpsm] shortcode if not needed. Implement input sanitization for post_content parameters and add output escaping in rendered pages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart