Front End PM CVE-2026-39788

Exploitation requires an authenticated account with at least Subscriber privileges on a WordPress site running Front End PM version 11.4.6 or earlier (PR:L); where this is most practical on sites that allow open/self user registration. The attacker injects a script payload through a Front End PM input (e.g., private message or profile field), and impact is realized only when a higher-privileged user views the stored content (UI:R), with the injected code then executing in that victim's security context (S:C). Limiting factors: the attacker cannot be fully anonymous (a low-privilege account is needed), a privileged victim must actively open the malicious content, and sites that disable user registration or restrict Subscriber capabilities substantially reduce exposure.

This is a stored/reflected Cross-Site Scripting flaw (CWE-79) in the Front End PM WordPress plugin at version 11.4.6 and earlier, assessed by Patchstack at CVSS 6.5 (medium). The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation that requires an authenticated low-privilege account (PR:L - the 'Subscriber' role named in the title) plus victim interaction (UI:R), with a scope change (S:C) because the injected script executes in the context of a higher-privileged user/browser session rather than the attacker's own. No EPSS score, KEV listing, or public POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The realistic risk is moderate-to-low in practice: the PR:L requirement means an attacker must already hold (or self-register, if open registration is enabled) a Subscriber account, and UI:R means a privileged victim must view the malicious content before impact occurs. The partial C:L/I:L/A:L impacts reflect typical XSS consequences (session/token theft, limited action-on-behalf, possible UI disruption) rather than full system compromise. There is no conflicting signal in the data; the main uncertainty is whether exploitation requires open user registration and whether the payload reaches an administrator, both of which materially change real-world severity.

An attacker registers or obtains a WordPress Subscriber account on a site running Front End PM <= 11.4.6 and submits a private message or profile field containing a malicious script payload. When an administrator or other privileged user opens that message in the WordPress dashboard, the script executes in their authenticated browser session (scope change), enabling session/cookie theft or actions performed as the victim. No public exploit code is identified at time of analysis, and the attack requires the victim to view the crafted content (UI:R).