CVE-2026-39693
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fesomia FSM Custom Featured Image Caption fsm-custom-featured-image-caption allows DOM-Based XSS. This issue affects FSM Custom Featured Image Caption: from n/a through <= 1.25.1.
Risk Assessment
The risk is the possibility of executing arbitrary JavaScript in the victim's browser, which can lead to session theft, redirects to malicious sites, or other actions in the context of the user's session.
Recommendation
It is recommended to update the FSM Custom Featured Image Caption plugin to a version newer than 1.25.1, which contains a fix for this vulnerability.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fesomia FSM Custom Featured Image Caption fsm-custom-featured-image-caption allows DOM-Based XSS.This issue affects FSM Custom Featured Image Caption: from n/a through <= 1.25.1.