CVE-2026-96649 is a stored DOM-based cross-site scripting vulnerability in the Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms WordPress plugin. The flaw exists in all versions up to and including 1.3.4 due to improper neutralization of input in the post_content parameter, specifically at a data-label DOM sink. Attackers can inject malicious scripts that execute in the context of users visiting the injected pages. The vulnerability requires that the site operator has enabled guest post submission via the [fpsm] shortcode, which registers an AJAX handler gated only by a nonce emitted on pages containing the shortcode. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with no availability impact.

An unauthenticated attacker can inject and store malicious scripts in the post_content parameter, which execute in the browsers of users who visit the affected pages. This can lead to unauthorized disclosure of information and modification of data within the context of the vulnerable site. The vulnerability does not impact availability. Exploitation requires guest post submission to be enabled, which exposes a publicly accessible AJAX endpoint protected only by a nonce.

No official patch or fix is currently documented. Site operators should consider disabling guest post submission via the [fpsm] shortcode to prevent exposure of the vulnerable AJAX handler. Monitor the vendor's advisory channels for updates or patches. Until a fix is available, avoid enabling guest post submissions or restrict access to the affected functionality.