CVE-2026-2382 is a stored cross-site scripting vulnerability in the FPW Category Thumbnails WordPress plugin affecting all versions up to 1.9.5. The vulnerability exists due to improper neutralization of input in the 'id' parameter of the 'fpw_fs_get_file' AJAX action, allowing authenticated users with Subscriber-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of the administrator when accessing the plugin's settings page, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 score of 6.4 reflects a medium impact with network attack vector, low attack complexity, and no user interaction required.

An attacker with at least Subscriber-level access can inject persistent malicious scripts that execute in the administrator's browser when they access the plugin settings. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed with administrator privileges. There is no impact on availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and limit administrator access to the plugin settings page. Monitor for updates from the plugin vendor and apply patches promptly once available.