Executive brief
The FPW Category Thumbnails plugin for WordPress, which allows site owners to manage category images, contains a security flaw. An attacker with a basic user account can inject malicious scripts into the website's management interface. These scripts execute when a site administrator visits the plugin's settings page, potentially allowing the attacker to perform unauthorized actions or compromise the administrator's session.
Technical details
The FPW Category Thumbnails plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'id' parameter within the 'fpw_fs_get_file' AJAX action. This vulnerability affects all versions up to and including 1.9.5. An authenticated attacker with Subscriber-level permissions or higher can send a specially crafted AJAX request to store malicious JavaScript. This script is subsequently executed in the context of an administrator's browser session when they navigate to the plugin's settings page. This could lead to session hijacking or unauthorized administrative actions. Users are advised to update to a patched version if available or disable the plugin.
Affected products
- WordPress FPW Category Thumbnails up to, and including, 1.9.5
Timeline
- 2026-06-02: disclosed: Vulnerability published to NVD
References
- https://plugins.trac.wordpress.org/browser/fpw-category-thumbnails/tags/1.9.5/ajax/getimageid.php
- https://plugins.trac.wordpress.org/browser/fpw-category-thumbnails/tags/1.9.5/classes/fpw-category-thumbnails-class.php
- https://plugins.trac.wordpress.org/browser/fpw-category-thumbnails/tags/1.9.5/code/table.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1fdbddd7-8713-48c8-98d6-0a155ca68325?source=cve