Description

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-01T05:17:07.357Z",
  "pubdate": "2026-09-01T05:17:07.357Z",
  "executiveSummary": "The Frontend Admin plugin for WordPress, in versions up to and including 3.29.11, contains a Stored Cross-Site Scripting (XSS) vulnerability.\nThis security flaw stems from inadequate input sanitization and output escaping within the 'tag' attribute of the plugin's shortcode functionality.\nThe vulnerability allows authenticated attackers with contributor-level privileges or higher to inject malicious JavaScript into web pages rendered by the plugin.\nWhen a victim, including administrators, views the affected page, the injected payload executes within the context of the user's browser session.\nSuccessful exploitation can result in unauthorized actions, session hijacking, credential theft, or the execution of arbitrary scripts on behalf of the victim.\nThe risk is elevated due to the ability of lower-privileged users to compromise higher-privileged accounts, potentially leading to full site takeover.\nImmediate remediation is required to mitigate the risk of unauthorized script execution in the WordPress environment.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), rooted in the improper handling of user-supplied input provided through the 'tag' attribute of the Frontend Admin shortcode.\nSpecifically, the plugin fails to sanitize the 'tag' input before storing it in the database and fails to perform proper output escaping when rendering the shortcode content on the frontend.\nThis allows an attacker to inject arbitrary HTML and JavaScript payloads directly into the application's data storage.\nThe exploitation flow proceeds as follows: First, a contributor-level user creates or edits a post or page, embedding the vulnerable shortcode with a maliciously crafted 'tag' attribute containing a JavaScript payload (e.g., [frontend-admin tag='<script>alert(document.cookie)</script>']).\nUpon saving the post, the malicious payload is stored in the WordPress database without validation or filtration.\nWhen any user—specifically an administrator or other high-privileged user—navigates to the page where the shortcode is processed, the plugin retrieves the unsanitized 'tag' value and renders it directly into the HTML response.\nThe browser interprets the injected script as legitimate code, resulting in execution within the victim's session.\nThis allows for post-exploitation activities such as exfiltrating session cookies, performing unauthorized administrative actions, or redirecting users to malicious external domains.\nThe vulnerability affects all versions up to and including 3.29.11 and is accessible to any user with the ability to edit posts, such as Contributors, Authors, and Editors.\nBecause the payload is stored persistently in the database, the script remains active until the specific post or shortcode is manually removed or the plugin is updated to include proper sanitization and escaping functions, such as esc_attr() for attribute rendering or wp_kses_post() for content output."
}