Executive brief
A vulnerability in the Frontend Admin by DynamiApps WordPress plugin allows unauthorized visitors to inject malicious scripts into website forms. This plugin is used to create front-end forms for users to submit content. If an attacker submits a specially crafted form entry, their malicious code could execute in the browser of any user—including site administrators—who views the submitted data, potentially leading to full site takeover or data theft.
Technical details
The Frontend Admin by DynamiApps plugin (acf-frontend-form-element) fails to properly sanitize form field inputs. Specifically, the plugin decodes HTML entities after the initial sanitization process, which effectively restores and 'activates' neutralized HTML tags. An unauthenticated attacker can submit a double-encoded payload that bypasses filters, resulting in the payload being stored as a live tag. When this stored value is later rendered on front-end display surfaces without escaping, the malicious script executes in the context of the viewing user's session. This vulnerability is fixed in version 3.29.9.
Affected products
- DynamiApps Frontend Admin by DynamiApps (acf-frontend-form-element) < 3.29.9
Timeline
- 2026-07-16: disclosed
- 2026-07-31: advisory: NVD publication date
- 2026-07-29: patched: Last updated/fixed version confirmed