FPSM Lite CVE-2026-96649

Exploitation requires the site operator to have enabled guest (unauthenticated) post submission via the [fpsm] shortcode, which registers a publicly accessible AJAX handler in ajax-process-form.php protected only by a nonce that is emitted on every page containing the shortcode (so the nonce provides no real barrier to an anonymous attacker). The payload is delivered through the post_content parameter and must reach the client-side data-label DOM sink in fpsml-fileuploader.js/fpsml-frontend.js. Affected: all versions up to and including 1.3.4; fixed in 1.3.5. Limiting factor: sites that have NOT enabled frontend/guest submission via [fpsm] are not exposed, since the AJAX handler and shortcode page are the entry point.

This is a genuine but conditional web-application risk rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High) reflects an unauthenticated, network-reachable stored XSS with a scope change (payload executes in the security context of any visitor, not just the attacker). However, the impact metrics are C:L/I:L/A:N, which correctly caps this below the critical tier - it is script execution in the browser, not server compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is 'no public exploit identified at time of analysis'; there is no SSVC decision data supplied either. The most important qualifier, stated explicitly in the description, is that exploitation depends on a non-default configuration: the site operator must have enabled guest post submission via the [fpsm] shortcode, which exposes the publicly accessible AJAX handler gated only by a per-page nonce. Where that feature is not enabled, the attack surface does not exist. There is no signal conflict between the CVSS network vector and the description (both indicate remote unauthenticated reach on affected configurations); the only nuance is that the raw score does not encode the configuration precondition, so real-world exposure is narrower than 7.2 suggests.

On a site that has enabled guest/frontend post submission via the [fpsm] shortcode, an unauthenticated attacker submits a post whose post_content contains a crafted payload that reaches the client-side data-label DOM sink (in fpsml-fileuploader.js / fpsml-frontend.js). Because input is neither sanitized server-side nor escaped on output, the script is stored and later executes in the browser of any user who views the injected page. No authentication or special privileges are required; the only public exploit signal is the vendor's own vulnerability writeup, not weaponized exploit code.