Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-96649 · Microsoft / collected KEV context

cve-program · CVE-2026-96649

• https://www.wordfence.com/threat-intel/vulnerabilities/id/0af8ff06-68e2-4a0c-9de4-d06a6a2e86c9?source=cve
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/assets/js/fpsml-fileuploader.js#L583
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/assets/js/fpsml-fileuploader.js#L578
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/assets/js/fpsml-frontend.js#L40
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/includes/cores/ajax-process-form.php#L5
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/includes/cores/ajax-process-form.php#L161
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/includes/classes/class-fpsml-library.php#L112
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.5/

No related operational record is retained in the current change model.