EUVD-2026-60923
GHSA-gxv9-2vc5-hx9v
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Contributor auth required (PR:L) and admin interaction required (UI:R); scope changes to privileged session; no material availability impact attributable to XSS.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.
AnalysisAI
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) enables contributor-level authenticated users to inject persistent malicious scripts through frontend-rendered forms. When a higher-privileged user such as an administrator subsequently views the affected content, the payload executes in their browser session, potentially enabling session hijacking, unauthorized administrative actions, or credential theft. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold at minimum a contributor-level WordPress account on the target site - the CVSS PR:L metric confirms that anonymous exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 (Medium) reflects meaningful mitigating factors: PR:L requires at minimum a contributor-level WordPress account, and UI:R requires a privileged user to interact with the poisoned content, reducing the population of exploitable endpoints compared to unauthenticated or zero-click XSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds or acquires a contributor-level WordPress account on a vulnerable site submits a crafted frontend form entry via the Frontend Admin plugin containing an embedded JavaScript payload - for example, a script tag within a text field that is rendered without encoding. When an administrator later visits the affected post or page in the course of normal site management, the script executes silently in their browser, exfiltrating the session cookie to an attacker-controlled endpoint or issuing authenticated API calls to create a rogue admin account. … |
| Remediation | Update the Frontend Admin by DynamiApps plugin beyond version 3.29.10 via the WordPress dashboard (Plugins > Updates) or by downloading directly from the WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Frontend Admin By Dynamiapps
View allStored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows una
Missing authorization in Frontend Admin by DynamiApps WordPress plugin (versions before 3.29.7) exposes taxonomy term cr
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers t
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets re
Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) a
Broken access control in Frontend Admin by DynamiApps (WordPress plugin, versions ≤ 3.29.10) allows subscriber-level aut
SQL Injection in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.28.28) allows authenticated a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today