Frontend Post Submission Manager Lite Guest Post And Frontend Submission Forms
Monthly
Stored DOM-based cross-site scripting in FPSM Lite through 1.3.4 lets unauthenticated attackers inject arbitrary scripts via the post_content parameter when the site has enabled guest post submission through the [fpsm] shortcode. The flaw is rooted in insufficient input sanitization and output escaping reaching a client-side data-label DOM sink, so the injected script executes when a victim views the affected page. No public exploit code has been identified, but exploitation is conditional on the shortcode-driven guest submission path being active; upgrading to 1.3.5 fixes the issue.
Stored DOM-based cross-site scripting in FPSM Lite through 1.3.4 lets unauthenticated attackers inject arbitrary scripts via the post_content parameter when the site has enabled guest post submission through the [fpsm] shortcode. The flaw is rooted in insufficient input sanitization and output escaping reaching a client-side data-label DOM sink, so the injected script executes when a victim views the affected page. No public exploit code has been identified, but exploitation is conditional on the shortcode-driven guest submission path being active; upgrading to 1.3.5 fixes the issue.