What is the CVSS score of EUVD-2026-51438?

EUVD-2026-51438 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Frontend Admin By Dynamiapps are affected by EUVD-2026-51438?

The Frontend Admin by DynamiApps WordPress plugin (versions before 3.29.9) contains a stored cross-site scripting vulnerability that permits unauthenticated attackers to inject malicious scripts…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-51438?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51438. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-51438?

Within 24 hours, identify all WordPress installations using the Frontend Admin by DynamiApps plugin and assess current versions; immediately update to version 3.29.9 or later. Within 7 days, verify patch deployment across all affected sites and confirm plugin functionality remains intact post-update. Within 30 days, review access logs and website audit trails for evidence of unauthorized administrative activity created before patching.

Frontend Admin By Dynamiapps EUVD-2026-51438

| CVE-2026-13609 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-31 WPScan

GHSA-pgxc-8xw2-rggm

WordPress XSS Frontend Admin By Dynamiapps Unknown

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 17:24 vuln.today

CVSS changed

Jul 31, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 31, 2026 - 06:00 cve.org

HIGH 8.8

DescriptionCVE.org

The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output without escaping on the Frontend Admin by DynamiApps WordPress plugin before 3.29.9's front-end display surfaces, resulting in stored cross-site scripting that executes in the browser of any user, including an administrator, who views a page displaying the submitted value.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

Stored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows unauthenticated visitors to permanently inject executable script content into site storage by exploiting a double-encoding sanitization bypass. The flaw arises because the plugin re-decodes HTML entities after sanitization, resurrecting neutralized tags; the live payload is then rendered without escaping on front-end display surfaces and fires in the browser of any authenticated user — including site administrators — who later views the affected page. A publicly available proof-of-concept exists; while no active exploitation is confirmed in CISA KEV, the unauthenticated attack surface and admin-session-hijacking potential make this a meaningful priority for WordPress operators running this plugin.