Is my WordPress plugin safe?

• Sep 29, 2026Frontend Post Submission Manager Lite – Frontend Posting: Stored DOM-Based Cross-Site ScriptingCVE-2026-96649 · affects up to 1.3.4 · reported by WordfenceHigh 7.2

  The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink) in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site operator to have enabled guest post submission via the [fpsm] shortcode, which registers a publicly accessible AJAX handler gated only by a nonce emitted on every page containing the shortcode.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 18, 2026Frontend Post Submission Manager Lite: Open RedirectionCVE-2026-1296 · affects up to 1.2.7 · reported by WordfenceMedium 6.1

  The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Dec 25, 2025Frontend Post Submission Manager Lite – Frontend Posting: Unauthorized loss of dataCVE-2025-14913 · affects up to 1.2.6 · reported by WordfenceMedium 5.3

  The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to an incorrect authorization check on the 'media_delete_action' function in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to delete arbitrary attachments.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Dec 20, 2025Frontend Post Submission Manager Lite: Missing AuthorizationCVE-2025-14080 · affects up to 1.2.5 · reported by WordfenceMedium 5.3

  The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsml_form_process AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary posts by providing a post_id parameter via the guest posting form, allowing them to change post titles, content, excerpts, and remove post authors.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 6, 2024Frontend Post Submission Manager Lite – Frontend Posting: Unauthorized modification of dataCVE-2024-8427 · affects up to 1.2.2 · reported by WordfenceMedium 4.3

  The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_global_settings and process_form_edit functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and forms.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.