CVE-2026-39693 in FSM Custom Featured Image Caption Plugin
Summary
by MITRE • 04/08/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fesomia FSM Custom Featured Image Caption fsm-custom-featured-image-caption allows DOM-Based XSS.This issue affects FSM Custom Featured Image Caption: from n/a through <= 1.25.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/08/2026
This vulnerability represents a critical cross-site scripting flaw that specifically targets the DOM-based execution environment within the fesomia FSM Custom Featured Image Caption plugin. The issue manifests when user-supplied input is inadequately sanitized during the web page generation process, creating an avenue for malicious script injection directly into the document object model. The vulnerability affects all versions up to and including 1.25.1, indicating a prolonged window of exposure for affected systems. The improper neutralization of input during web page generation creates a pathway for attackers to inject malicious JavaScript code that executes in the context of the victim's browser, potentially compromising user sessions and data integrity. This type of vulnerability falls under the CWE-79 category for Cross-site Scripting, specifically the DOM-based variant where the attack occurs entirely within the client-side environment rather than being transmitted through server-side processing. The attack vector leverages the plugin's handling of featured image captions where user-provided content is rendered without proper sanitization, allowing malicious input to be interpreted as executable JavaScript code by the browser's DOM parser. The operational impact extends beyond simple script execution as this vulnerability can enable session hijacking, data theft, and potentially full system compromise if attackers can leverage the executed scripts to perform additional malicious activities. The DOM-based nature of this vulnerability means that the malicious payload is injected directly into the page's DOM structure, making it particularly challenging to detect through traditional server-side input validation methods. This vulnerability aligns with ATT&CK technique T1566.001 for Initial Access through Phishing, as attackers can craft malicious captions that, when viewed by unsuspecting users, execute malicious scripts in their browsers. The flaw represents a fundamental breakdown in the plugin's input validation and output encoding mechanisms, where user-supplied data flows directly into DOM manipulation functions without proper sanitization or escaping. Organizations running affected versions of this plugin face significant risk as the vulnerability allows for persistent script execution within the context of legitimate user sessions, potentially enabling attackers to access sensitive information, modify content, or redirect users to malicious sites. The remediation approach requires immediate patching to versions that properly sanitize user input during caption processing and implement proper DOM-based output encoding to prevent script injection attacks. Security teams should also consider implementing Content Security Policy headers as an additional defense-in-depth measure to mitigate the impact of such vulnerabilities even when present in the application code. The vulnerability demonstrates the critical importance of proper input validation and output encoding in web applications, particularly in plugins that handle user-generated content and directly manipulate the DOM structure of web pages.