The vulnerability CVE-2026-39693 affects the fesomia FSM Custom Featured Image Caption plugin (versions up to 1.25.1) and is characterized by improper neutralization of input during web page generation, resulting in a DOM-based cross-site scripting (XSS) flaw. This allows an attacker with high privileges and requiring user interaction to potentially execute malicious scripts in the context of the affected web application, impacting confidentiality, integrity, and availability to a limited degree. The CVSS 3.1 base score is 5.9, indicating medium severity. No patch or official remediation level has been published yet.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary scripts in the victim's browser via DOM-based XSS, potentially leading to limited confidentiality, integrity, and availability impacts. However, exploitation requires user interaction and elevated privileges, reducing the overall risk. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit exposure by restricting high privilege access and exercising caution with user input handling related to the FSM Custom Featured Image Caption plugin. Monitor vendor communications for updates on patches or mitigations.