CVE-2026-39693

CVE-2026-39693 is a DOM-based cross-site scripting (XSS) vulnerability in the FSM Custom Featured Image Caption WordPress plugin, affecting versions 1.25.1 and earlier. The flaw allows improper neutralization of user input during web page generation, creating a potential security gap in the plugin's functionality. The vulnerability carries a CVSS severity score of 5.9 (Medium) with a network-based attack vector requiring low complexity and high privilege user interaction. The impact is limited to low-level confidentiality, integrity, and availability concerns, with a scope change to the connected system. The EPSS score of 0.00033 indicates minimal prevalence compared to other disclosed vulnerabilities. There is currently no evidence of active exploitation, and the vulnerability does not appear on any known exploits (KEV) list or active threat tracking databases. Community attention remains low, as reflected by the inactive Hot List status. Organizations using the affected plugin should apply updates to versions after 1.25.1 to mitigate this DOM-based XSS risk, though the immediate threat level remains low.