Frontend Admin By Dynamiapps
Monthly
Stored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows unauthenticated visitors to permanently inject executable script content into site storage by exploiting a double-encoding sanitization bypass. The flaw arises because the plugin re-decodes HTML entities after sanitization, resurrecting neutralized tags; the live payload is then rendered without escaping on front-end display surfaces and fires in the browser of any authenticated user — including site administrators — who later views the affected page. A publicly available proof-of-concept exists; while no active exploitation is confirmed in CISA KEV, the unauthenticated attack surface and admin-session-hijacking potential make this a meaningful priority for WordPress operators running this plugin.
Missing authorization in Frontend Admin by DynamiApps WordPress plugin (versions before 3.29.7) exposes taxonomy term creation, modification, and deletion operations to any authenticated user, including Subscribers - the lowest WordPress role. Rooted in CWE-862 (Missing Authorization), the plugin's taxonomy management handlers execute without invoking WordPress capability checks, granting low-privilege accounts editor-level control over site taxonomy. A public POC is available via WPScan; however, EPSS sits at 0.14% (4th percentile) and no CISA KEV listing exists, suggesting limited real-world exploitation activity despite the accessible POC.
SQL Injection in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.28.28) allows authenticated administrators to extract arbitrary data from the WordPress database via the 'order' parameter in the payments list view. The vulnerability stems from unsanitized concatenation of user-supplied input into a raw SQL query, reachable only when a valid 'orderby' parameter is also present in the same request. No public exploit has been identified at time of analysis, and the high privilege requirement (administrator-level) substantially limits the realistic attacker pool, keeping this a medium-severity, low-urgency finding despite the AV:N classification.
Stored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows unauthenticated visitors to permanently inject executable script content into site storage by exploiting a double-encoding sanitization bypass. The flaw arises because the plugin re-decodes HTML entities after sanitization, resurrecting neutralized tags; the live payload is then rendered without escaping on front-end display surfaces and fires in the browser of any authenticated user — including site administrators — who later views the affected page. A publicly available proof-of-concept exists; while no active exploitation is confirmed in CISA KEV, the unauthenticated attack surface and admin-session-hijacking potential make this a meaningful priority for WordPress operators running this plugin.
Missing authorization in Frontend Admin by DynamiApps WordPress plugin (versions before 3.29.7) exposes taxonomy term creation, modification, and deletion operations to any authenticated user, including Subscribers - the lowest WordPress role. Rooted in CWE-862 (Missing Authorization), the plugin's taxonomy management handlers execute without invoking WordPress capability checks, granting low-privilege accounts editor-level control over site taxonomy. A public POC is available via WPScan; however, EPSS sits at 0.14% (4th percentile) and no CISA KEV listing exists, suggesting limited real-world exploitation activity despite the accessible POC.
SQL Injection in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.28.28) allows authenticated administrators to extract arbitrary data from the WordPress database via the 'order' parameter in the payments list view. The vulnerability stems from unsanitized concatenation of user-supplied input into a raw SQL query, reachable only when a valid 'orderby' parameter is also present in the same request. No public exploit has been identified at time of analysis, and the high privilege requirement (administrator-level) substantially limits the realistic attacker pool, keeping this a medium-severity, low-urgency finding despite the AV:N classification.