EUVD-2026-68978
GHSA-mw4w-62hv-vc72
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor-level authentication required (PR:L); stored XSS crosses scope boundary into victims' browser sessions (S:C); no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.11) allows authenticated contributors to inject persistent malicious scripts via the 'tag' shortcode attribute, executing in the browser of any user who subsequently visits the compromised page. The scope change (S:C in CVSS) reflects the cross-context impact: scripts run under victims' browser sessions, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with at minimum contributor-level role - anonymous or subscriber-level users cannot create or edit content with shortcodes and are therefore unable to trigger the injection point. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.4 Medium score is appropriately calibrated: PR:L (contributor-level authentication required) meaningfully limits the attack surface relative to unauthenticated XSS, but S:C (scope change) correctly captures the cross-session impact that makes stored XSS operationally dangerous even at medium severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Frontend Admin by DynamiApps plugin to version 3.29.12 or later, which contains corrected sanitization and escaping in the 'tag' shortcode handler as visible in the patched source at plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.12/main/frontend/forms/classes/shortcodes.php. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Frontend Admin By Dynamiapps
View allStored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows una
Missing authorization in Frontend Admin by DynamiApps WordPress plugin (versions before 3.29.7) exposes taxonomy term cr
Unauthenticated path traversal file deletion in the Frontend Admin by DynamiApps WordPress plugin before 3.29.13 allows
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers t
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets re
Unauthenticated account takeover in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.12) let
Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) a
Unauthorized deletion of arbitrary membership plans is possible in the Frontend Admin by DynamiApps WordPress plugin (al
Unauthenticated arbitrary file deletion in the Frontend Admin by DynamiApps WordPress plugin (versions up to and includi
Broken access control in Frontend Admin by DynamiApps (WordPress plugin, versions ≤ 3.29.10) allows subscriber-level aut
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10)
SQL Injection in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.28.28) allows authenticated a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today