Stored Cross-Site Scripting Vulnerability in FPW Category Thumbnails Plugin for WordPress

CVE-2026-2382

What is CVE-2026-2382?

The FPW Category Thumbnails plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to improper input sanitization and lack of output escaping in the 'id' parameter of the 'fpw_fs_get_file' AJAX action. Authenticated users with Subscriber-level access and higher can exploit this flaw to inject arbitrary scripts. This injection can lead to malicious code execution when an administrator accesses the plugin's settings page, posing a serious threat to the integrity and security of the WordPress site.

References