EUVD-2026-51438
GHSA-pgxc-8xw2-rggm
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Stored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows unauthenticated visitors to permanently inject executable script content into site storage by exploiting a double-encoding sanitization bypass. The flaw arises because the plugin re-decodes HTML entities after sanitization, resurrecting neutralized tags; the live payload is then rendered without escaping on front-end display surfaces and fires in the browser of any authenticated user — including site administrators — who later views the affected page. A publicly available proof-of-concept exists; while no active exploitation is confirmed in CISA KEV, the unauthenticated attack surface and admin-session-hijacking potential make this a meaningful priority for WordPress operators running this plugin.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Frontend Admin By Dynamiapps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (WPScan) · only source for this CVE.
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output without escaping on the Frontend Admin by DynamiApps WordPress plugin before 3.29.9's front-end display surfaces, resulting in stored cross-site scripting that executes in the browser of any user, including an administrator, who views a page displaying the submitted value.
Articles & Coverage 1
Executive ViewAI
The Frontend Admin by DynamiApps WordPress plugin (versions before 3.29.9) contains a stored cross-site scripting vulnerability that permits unauthenticated attackers to inject malicious scripts which execute in administrator browsers upon page viewing. WordPress operators using this plugin face elevated risk of admin account compromise and site takeover. Organizations should immediately identify affected deployments and apply the available patch.
Within 24 hours, identify all WordPress installations using the Frontend Admin by DynamiApps plugin and assess current versions; immediately update to version 3.29.9 or later. Within 7 days, verify patch deployment across all affected sites and confirm plugin functionality remains intact post-update. Within 30 days, review access logs and website audit trails for evidence of unauthorized administrative activity created before patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Frontend Admin By Dynamiapps
View allMissing authorization in Frontend Admin by DynamiApps WordPress plugin (versions before 3.29.7) exposes taxonomy term cr
Unauthenticated path traversal file deletion in the Frontend Admin by DynamiApps WordPress plugin before 3.29.13 allows
Unauthenticated account takeover in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.12) let
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers t
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets re
Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) a
Privilege escalation in Frontend Admin by DynamiApps plugin allows authenticated attackers with editor-level access to e
Unauthenticated privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.2) allows a
Unauthorized deletion of arbitrary membership plans is possible in the Frontend Admin by DynamiApps WordPress plugin (al
Unauthenticated arbitrary file deletion in the Frontend Admin by DynamiApps WordPress plugin (versions up to and includi
SQL injection in the Frontend Admin by DynamiApps WordPress plugin (all versions up to and including 3.29.13) lets an au
Exploit-DB