What is the CVSS score of CVE-2026-66638?

CVE-2026-66638 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Frontend Admin CVE-2026-66638

EUVD-2026-60923 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-18 Patchstack

GHSA-gxv9-2vc5-hx9v

WordPress XSS Frontend Admin By Dynamiapps Wordpress Plugin Shabti Kaplan

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor auth required (PR:L) and admin interaction required (UI:R); scope changes to privileged session; no material availability impact attributable to XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:43 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.

AnalysisAI

Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) enables contributor-level authenticated users to inject persistent malicious scripts through frontend-rendered forms. When a higher-privileged user such as an administrator subsequently views the affected content, the payload executes in their browser session, potentially enabling session hijacking, unauthorized administrative actions, or credential theft. No CISA KEV listing or confirmed public exploit code has been identified at time of analysis, though the low-privilege entry point makes this a realistic and practical threat in multi-author WordPress environments.

Technical ContextAI

Frontend Admin by DynamiApps (CPE: cpe:2.3:a:shabti_kaplan:frontend_admin_by_dynamiapps) is a WordPress plugin that exposes Advanced Custom Fields (ACF) form rendering on the frontend, permitting lower-privileged users such as contributors to submit and edit post content without accessing the WordPress admin dashboard. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), meaning user-controlled input submitted through these frontend forms is insufficiently sanitized or encoded before being rendered back into page output. The CVSS S:C (Scope Changed) metric is technically significant: it confirms the injected payload transcends the contributor's own session boundary and executes in the context of whatever privileged user views the poisoned content, enabling effective privilege escalation through the browser.

RemediationAI

Update the Frontend Admin by DynamiApps plugin beyond version 3.29.10 via the WordPress dashboard (Plugins > Updates) or by downloading directly from the WordPress plugin repository. The exact fixed version should be confirmed against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/acf-frontend-form-element/vulnerability/wordpress-frontend-admin-by-dynamiapps-plugin-3-29-10-cross-site-scripting-xss-vulnerability before deploying, as that version was not independently verified from the available data. As a compensating control pending upgrade, administrators should audit and minimise contributor-level accounts, particularly those granted to untrusted or external users, since PR:L is the required entry condition - eliminating unnecessary contributor accounts directly removes the exploitation path. Patchstack customers may apply the platform's virtual patching rules as an interim measure. Enabling a WAF rule targeting stored XSS injection patterns adds a detection layer but should not substitute for patching, as WAF bypass is achievable by a motivated attacker.