CVE-2026-1296mediumCWE-601

CVE-2026-1296: medium-severity vulnerability in wpshuffle Frontend Post Submission Manager…

Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter

Published

Follow this CVE+ Monitor Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 6.1epss 0.5%
The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
wpshuffle · Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin
Related CVEs — wpshuffle Frontend Post Submission Manager…

In the same product, most dangerous first.

CVE-2024-8427MEDIUMFrontend Post Submission Manager Lite – Frontend Posting WordPress Plugin <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings UpdateEPSS 0.3%CVE-2025-14913MEDIUMFrontend Post Submission Manager Lite <= 1.2.6 - Incorrect Authorization to Unauthenticated Arbitrary Attachment DeletionEPSS 0.3%CVE-2025-14080MEDIUMFrontend Post Submission Manager Lite <= 1.2.5 - Missing Authorization to Unauthenticated Arbitrary Post ModificationEPSS 0.3%