CVE-2026-39788: WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability

Q: Which installations are affected?

WordPress sites running Front End PM version 11.4.6 or earlier are affected according to the available data.

Q: What access does an attacker need?

Exploitation requires a low-privileged authenticated account, identified as a Subscriber account. The attack can be performed over the network, but it also requires user interaction.

Q: What is the likely impact if exploitation succeeds?

The vulnerability is rated medium severity with low confidentiality, integrity, and availability impact. Its scope is changed, indicating the impact may extend beyond the initially vulnerable component's security authority.

Published Oct 6, 2026

Updated

Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.

Affected Software

1 affected component

WordPress Front End PM<=11.4.6

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

WordPress sites running Front End PM version 11.4.6 or earlier are affected according to the available data.

What access does an attacker need?

Exploitation requires a low-privileged authenticated account, identified as a Subscriber account. The attack can be performed over the network, but it also requires user interaction.

What is the likely impact if exploitation succeeds?

The vulnerability is rated medium severity with low confidentiality, integrity, and availability impact. Its scope is changed, indicating the impact may extend beyond the initially vulnerable component's security authority.

CVE-2026-39788: WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability

Affected Software

Event History

Frequently Asked Questions

Which installations are affected?

What access does an attacker need?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What access does an attacker need?

What is the likely impact if exploitation succeeds?