Description

Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T15:16:58.500Z",
  "pubdate": "2026-08-18T15:16:58.500Z",
  "executiveSummary": "A Cross Site Scripting (XSS) vulnerability exists in the Frontend Admin plugin developed by DynamiApps, affecting versions up to and including 3.29.10. This security flaw enables authenticated users with low-level privileges, specifically contributors, to inject and persist malicious scripts into application pages rendered to other users. The vulnerability arises from insufficient input sanitization and output encoding within the frontend administration interface. Successful exploitation of this vulnerability can lead to severe security implications, including the potential hijacking of sessions, unauthorized access to sensitive administrative functionalities, modification of page content, and the execution of arbitrary JavaScript within the context of a victim's browser session. While exploitation requires authenticated access at the contributor privilege level, the resulting impact can compromise the integrity and confidentiality of the affected WordPress site, particularly if higher-privileged users interact with the malicious payload.",
  "technicalDetails": "The vulnerability is classified as a Cross Site Scripting (XSS) flaw residing within the Frontend Admin plugin by DynamiApps for versions <= 3.29.10. The root cause of the issue stems from inadequate input validation and a lack of proper context-aware output encoding applied to user-supplied data processed by the plugin's administrative frontend components. Specifically, when a user with contributor-level privileges submits data through the affected forms or parameters handled by the vulnerable component, the application fails to adequately strip or neutralize executable HTML and JavaScript constructs before storing them or rendering them back to the Document Object Model (DOM). The attack flow begins with an authenticated attacker possessing contributor privileges crafting a malicious payload containing arbitrary JavaScript. The attacker then submits this payload through the vulnerable input vectors exposed by the Frontend Admin interface. The application improperly accepts and persists the input without applying rigorous sanitization routines. When an unsuspecting user, such as an administrator or higher-privileged user, visits the compromised frontend administration page, the stored payload is retrieved from the database and rendered directly into the victim's browser without appropriate escaping. Consequently, the browser executes the malicious script within the security context of the victim's session. The execution of this arbitrary JavaScript payload facilitates post-exploitation activities, such as session token theft, unauthorized API requests executed on behalf of the victim, defacement of the frontend interface, or the potential escalation of privileges depending on the target user interacting with the payload. The vulnerability requires network access to the web application and necessitates authenticated access restricted to the contributor role, limiting remote unauthenticated exploitation but posing a significant risk from malicious or compromised internal contributors."
}