Fsm Custom Featured Image Caption EUVD-2026-20389

This vulnerability exploits improper output encoding in WordPress plugin code responsible for generating and displaying featured image captions in the DOM (Document Object Model). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), which occurs when user-controlled input is inserted into HTML or JavaScript contexts without proper escaping or sanitization. The WordPress plugin (CPE: cpe:2.3:a:fesomia:fsm_custom_featured_image_caption) fails to neutralize special characters or script tags when rendering caption data to the client-side DOM, allowing injected JavaScript to execute in the browser context of other administrators who view the affected page. This is specifically a DOM-based XSS variant rather than stored or reflected, meaning the malicious payload is processed client-side within the page structure itself.