CVE-2026-1296

The record

The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.

Affected packages

Related vulnerabilities

• CVE-2026-87945 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO… CWE-601
• CVE-2026-87937 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central… CWE-601
• CVE-2026-112034 A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. CWE-601
• CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. CWE-601
• CVE-2026-8323 URL redirection to untrusted site ('open redirect') vulnerability in Armiya Information… CWE-601
• CVE-2026-78377 URL redirection to untrusted site ('open redirect') vulnerability in Yordam Informatics… CWE-601
• CVE-2026-81741 The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2… CWE-601
• CVE-2026-84389 A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM… CWE-601