All vulnerabilities
CVE-2026-1296

Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter

wpshuffle Frontend Post Submission Manager Lite – Frontend Posting WordPress PluginApplications & CMS
Open in ThreatlineRecord JSON
CVSS
6.1Medium
ExploitationScanner template publicA Nuclei template detects it. Not in the KEV catalogNuclei
Exploit odds (EPSS)0.52%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published18 Feb 2026Updated 18 Feb 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Timeline

  1. 18 Feb 2026, 04:35 UTCPublishedCVE List
  2. 27 Oct 2026, 13:25 UTCExploit code publicGitHub proof-of-concept repositories

Public exploit code and templates 1

  • Scanner templateFrontend Post Submission Manager Lite <= 1.2.7 - Open RedirectNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.

Text from CVE List

Affected versions 1

  • Frontend Post Submission Manager Lite – Frontend Posting WordPress Pluginaffected: 1.0.0 through 1.2.7CVE List

References 4