Frontend Admin CVE-2026-12747

Exploitation requires an authenticated WordPress account with at minimum contributor-level role - anonymous or subscriber-level users cannot create or edit content with shortcodes and are therefore unable to trigger the injection point. The target site must have the Frontend Admin by DynamiApps plugin installed and active at version 3.29.11 or earlier. The attacker must have the ability to publish or submit content containing the vulnerable 'tag' shortcode attribute, which is gated by the contributor role's standard post-creation capability. The payload executes automatically when any user (including administrators) loads the page - no further interaction beyond normal page browsing is required on the victim's side. Sites that restrict contributor registration, enforce role hygiene, or require editorial review before content publication substantially limit the exploitability window.

The CVSS 6.4 Medium score is appropriately calibrated: PR:L (contributor-level authentication required) meaningfully limits the attack surface relative to unauthenticated XSS, but S:C (scope change) correctly captures the cross-session impact that makes stored XSS operationally dangerous even at medium severity. On multi-author WordPress sites with open contributor registration, the authentication barrier is low. No EPSS score was provided in the input data, and the CVE is absent from CISA KEV, indicating no confirmed widespread exploitation at time of analysis. Real-world priority should be elevated for sites where contributor registration is open or where the plugin is actively used to build frontend forms - the stored nature means a single injection compromises every subsequent visitor, including administrators whose hijacked sessions could enable full site takeover. UI:N in the CVSS vector reflects Wordfence's convention that a victim's normal page browsing does not constitute a required interaction; this is consistent with stored XSS classification.

An attacker registers or compromises a contributor-level WordPress account on a target site running Frontend Admin by DynamiApps ≤3.29.11, then creates or edits a post embedding a shortcode with a crafted 'tag' attribute containing JavaScript (e.g., an event handler or script block). When a site administrator or logged-in user browses to that page, the injected script executes in their browser session, and the attacker can exfiltrate the admin's authentication cookies or perform privileged WordPress actions via AJAX. No public exploit code has been identified at time of analysis, but the exploitation technique is elementary for anyone familiar with WordPress shortcode XSS.