CVE-2026-2382: WordPress FPW Category Thumbnails XSS Flaw

CVE-2026-2382 Overview

CVE-2026-2382 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the FPW Category Thumbnails plugin for WordPress in all versions up to and including 1.9.5. The flaw resides in the id parameter of the fpw_fs_get_file AJAX action, where the plugin fails to properly sanitize input and escape output. Authenticated users with Subscriber-level access or higher can inject arbitrary JavaScript that executes when an administrator visits the plugin's settings page. The issue is classified under CWE-79 and tracks to a low privilege requirement with a scope change, since injected scripts execute in the administrator's browser context.

Critical Impact
Authenticated low-privilege attackers can persist malicious scripts that execute in an administrator's session, enabling account takeover, plugin modification, or installation of malicious WordPress content.

Affected Products

FPW Category Thumbnails plugin for WordPress, versions up to and including 1.9.5
WordPress sites permitting Subscriber-level registration with the plugin active
Administrator sessions accessing the plugin's settings page

Discovery Timeline

2026-06-02 - CVE-2026-2382 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-2382

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw in the AJAX handler exposed by the FPW Category Thumbnails plugin. The plugin registers an AJAX action named fpw_fs_get_file that accepts an id parameter from the client. According to the WordPress plugin source, the value supplied by the requester is processed and later persisted in a context that influences the plugin's settings or table rendering. When this stored value is later emitted into the plugin's admin pages without proper escaping, the browser interprets attacker-supplied markup as executable script.

Because the AJAX endpoint is reachable by authenticated users at the Subscriber role and above, the attack does not require elevated privileges. The CWE-79 classification reflects an improper neutralization of input during web page generation. The CVSS scope change indicates the impact crosses a security boundary, since the attacker's payload executes inside an administrator's authenticated session.

Root Cause

The root cause is insufficient input sanitization on the id parameter combined with missing output escaping when the value is rendered. The plugin does not apply WordPress functions such as sanitize_text_field() on input or esc_html() / esc_attr() on output. The affected handler and the rendering paths in the class definition and the table code emit the stored value directly into the admin UI.

Attack Vector

An authenticated Subscriber sends a crafted request to the admin-ajax.php endpoint invoking the fpw_fs_get_file action with a malicious id value containing HTML or JavaScript. The payload is persisted by the plugin. When a WordPress administrator subsequently loads the plugin's settings page, the script executes with the administrator's privileges, enabling session hijacking, CSRF-token theft, or arbitrary administrative actions through the REST API.

No verified public exploit code is available. Refer to the Wordfence vulnerability analysis for additional technical context.

Detection Methods for CVE-2026-2382

Indicators of Compromise

POST requests to wp-admin/admin-ajax.php with action=fpw_fs_get_file originating from low-privilege user accounts.
id parameter values containing HTML tags, <script> fragments, javascript: URIs, or event handlers such as onerror= and onload=.
Unexpected outbound requests from administrator browsers shortly after visiting the FPW Category Thumbnails settings page.
New administrator accounts, plugin installations, or modified theme files following an admin session that loaded the plugin settings page.

Detection Strategies

Inspect WordPress access logs for admin-ajax.php calls with the fpw_fs_get_file action submitted by non-administrator users.
Review the plugin's stored configuration and database tables for entries in the id field containing HTML or script syntax.
Deploy a Web Application Firewall ruleset matching XSS patterns on POST bodies targeting the affected AJAX action.

Monitoring Recommendations

Alert on any AJAX action invocations by Subscriber or Contributor accounts that historically only browse front-end content.
Monitor administrator browser sessions for anomalous outbound DOM requests to attacker-controlled domains.
Track changes to the WordPress wp_users, wp_options, and plugin-specific tables for unauthorized modifications correlated with admin page visits.

How to Mitigate CVE-2026-2382

Immediate Actions Required

Deactivate the FPW Category Thumbnails plugin until a patched release beyond version 1.9.5 is confirmed available.
Audit existing user accounts and revoke unused Subscriber-level or higher accounts that may have been created for exploitation.
Review stored plugin data and remove any entries containing HTML or JavaScript content from the id field.
Force a password reset and session invalidation for all administrator accounts that accessed the plugin's settings page.

Patch Information

At the time of CVE publication on 2026-06-02, the vulnerability affects all versions up to and including 1.9.5. Apply the vendor's fixed release once published. Monitor the WordPress plugin repository and the Wordfence advisory for the patched version.

Workarounds

Disable open user registration on the WordPress site, or restrict the default role to one that cannot reach admin-ajax.php privileged actions.
Apply a WAF rule blocking POST requests where action=fpw_fs_get_file is submitted by non-administrator users.
Restrict access to /wp-admin/admin-ajax.php for the fpw_fs_get_file action via server-level rules until the patch is applied.
Remove the plugin entirely if it is not essential to site operations.

bash

# Configuration example: nginx rule to block the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "fpw_fs_get_file") {
        return 403;
    }
    if ($request_body ~* "action=fpw_fs_get_file") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}