The FSM Custom Featured Image Caption plugin contains a DOM‑based XSS flaw caused by improper sanitization of content that is reflected back to the user’s browser. An attacker can embed malicious script code into the caption text, which is then executed in a victim’s browser. The impact is the ability to execute arbitrary client‑side code, enabling session hijacking, defacement, or the delivery of malware to a user. This weakness is identified as CWE‑79.

The vulnerability affects the WordPress plugin FSM Custom Featured Image Caption from any released version through 1.25.1, published by fesomia. Users who have the plugin installed on their WordPress site with a version equal to or lower than 1.25.1 are exposed to this issue.

With a CVSS score of 5.9 the exploitability is moderate; an attacker needs to lure a user to a crafted URL or otherwise inject malicious caption content. EPSS indicates less than 1% probability of exploitation, and there is no listing in the CISA KEV catalog, suggesting low current exploitation activity. The threat remains real, especially for high‑traffic sites that allow user‑generated captions.