Executive brief
The Frontend Admin by DynamiApps is a WordPress plugin that allows website administrators to create frontend forms. A stored cross-site scripting vulnerability allows attackers with contributor-level access to inject malicious scripts into pages via shortcode attributes. When other users visit affected pages, these scripts execute in their browsers, potentially leading to account hijacking, data theft, or malware infection.
Technical details
The plugin fails to properly sanitize and escape user input in the 'tag' shortcode attribute, leading to stored XSS. An authenticated attacker with contributor-level permissions or above can inject arbitrary JavaScript via the affected shortcode, which is then persistently stored in the database. The malicious script executes whenever any user accesses a page containing the injected shortcode. This vulnerability requires authentication and contributor-level access, but affects all users who subsequently view the compromised pages. A patch is available in version 3.29.12 and later.
Affected products
- DynamiApps Frontend Admin up to and including 3.29.11
Timeline
- 2026-09-01: disclosed