CVE-2026-2382 is a stored cross-site scripting vulnerability in the FPW Category Thumbnails WordPress plugin. The flaw exists in the handling of the 'id' parameter of the 'fpw_fs_get_file' AJAX action, where input is not properly sanitized or escaped before being rendered. This allows authenticated users with at least Subscriber privileges to inject arbitrary web scripts that execute in the context of administrators viewing the plugin settings, potentially leading to privilege escalation or session hijacking. The vulnerability affects all plugin versions up to and including 1.9.5. No official patch or remediation guidance has been published as of the data provided.

An attacker with Subscriber-level access or higher can exploit this vulnerability to inject and store malicious scripts that execute when an administrator accesses the plugin's settings page. This can lead to the compromise of administrator accounts, unauthorized actions, or theft of sensitive information. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low complexity, required privileges, no user interaction, and impact on confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's settings page to trusted administrators only and monitor for suspicious activity. Consider disabling or removing the FPW Category Thumbnails plugin if it is not essential. Avoid granting Subscriber or higher privileges to untrusted users.