Frontend Admin CVE-2026-6243

Exploitation requires an authenticated account with Contributor-level role or higher on a WordPress site running the Frontend Admin by DynamiApps plugin at version 3.28.36 or earlier; the flaw is reached through the plugin's 'get_dynamic_values' function, which performs non-HTML-aware text find-and-replace on post content, allowing a kses/mutation-XSS bypass. The payload is stored and executes only when a user subsequently views the affected page (no interaction needed from the attacker at execution time). Limiting factors: the attacker must already hold at least Contributor access (not anonymous), the plugin must be installed and active, and the vulnerable code path through dynamic-value replacement must be exercised on the submitted content; sites that do not grant untrusted users Contributor-or-higher roles face substantially lower practical risk.

This is a moderate-priority issue, not a top-tier emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) is internally consistent with the description: network-reachable, low-complexity, requires Contributor-level authentication (PR:L), no victim interaction to inject (UI:N) because the payload is stored and fires when any user later views the page, and a changed scope (S:C) reflecting execution in the victim's browser rather than the WordPress application itself. The low confidentiality and integrity impacts (C:L/I:L, A:N) are appropriate for stored XSS. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' The main risk driver is the low authentication bar - Contributor accounts are frequently granted on multi-author or membership sites, and this role is normally trusted only with unprivileged, kses-sanitized content; this flaw defeats that sanitization via mutation XSS, enabling a low-privilege user to escalate impact against higher-privileged viewers (e.g., administrators). No conflicting signals are present between the CVSS vector and the description. Absence of EPSS/KEV/POC data is a genuine data gap, not evidence of low risk, but on balance this warrants prompt patching rather than crisis response.

A site operator grants Contributor access to a guest author on a multi-author WordPress site. The attacker submits post content crafted so that the plugin's text-level find-and-replace in 'get_dynamic_values' mutates otherwise-sanitized markup into executable HTML, bypassing kses. When an administrator or visitor later opens the page, the injected JavaScript runs in their browser, enabling session/cookie theft or admin actions via the victim's authenticated context. No public exploit code was identified at the time of analysis.