Is CVE-2026-12747 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12747 being exploited in the wild.

How severe is CVE-2026-12747?

Medium severity, with a CVSS score of 6.4, published 1 September 2026.

Which products and versions are affected?

DynamiApps Frontend Admin up to and including 3.29.11.

Is there a fix for CVE-2026-12747?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12747 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-12747?

Check whether you run DynamiApps Frontend Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12747: Frontend Admin by DynamiApps stored XSS via tag shortcode attribute

CVE-2026-12747 · Severity: medium · CVSS 6.4 · Published 2026-09-01

The Frontend Admin by DynamiApps is a WordPress plugin that allows website administrators to create frontend forms. A stored cross-site scripting vulnerability allows attackers with contributor-level access to inject malicious scripts into pages via shortcode attributes. When other users visit affected pages, these scripts execute in their browsers, potentially leading to account hijacking, data theft, or malware infection.

Technologies: DynamiApps Frontend Admin. Vendors: DynamiApps.

Quick answers

Is CVE-2026-12747 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12747 being exploited in the wild.
How severe is CVE-2026-12747?: Medium severity, with a CVSS score of 6.4, published 1 September 2026.
Which products and versions are affected?: DynamiApps Frontend Admin up to and including 3.29.11.
Is there a fix for CVE-2026-12747?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12747 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-12747?: Check whether you run DynamiApps Frontend Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin fails to properly sanitize and escape user input in the 'tag' shortcode attribute, leading to stored XSS. An authenticated attacker with contributor-level permissions or above can inject arbitrary JavaScript via the affected shortcode, which is then persistently stored in the database. The malicious script executes whenever any user accesses a page containing the injected shortcode. This vulnerability requires authentication and contributor-level access, but affects all users who subsequently view the compromised pages. A patch is available in version 3.29.12 and later.

Affected products

DynamiApps Frontend Admin up to and including 3.29.11

Timeline

2026-09-01: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.