Executive Summary

The Frontend Admin by DynamiApps WordPress plugin before version 3.29.9 is vulnerable to stored cross-site scripting (XSS). An unauthenticated attacker can exploit this vulnerability by submitting a crafted payload that is stored and later executed in the browser of any user who views the submitted value. This vulnerability has a CVSS score of 8.8, indicating high severity.

Technical Analysis

The vulnerability class of CVE-2026-13609 is stored cross-site scripting (XSS). The attack vector involves an unauthenticated visitor submitting a double-encoded payload through a form field. The plugin decodes HTML entities in the submitted value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. The root cause of this vulnerability is the improper handling of user input, specifically the decoding of HTML entities after sanitization.

How It Gets Exploited

An unauthenticated remote attacker submits a double-encoded payload through a form field on the Frontend Admin by DynamiApps WordPress plugin before 3.29.9. The payload is stored as a live tag and later output without escaping on the plugin's front-end display surfaces. When any user, including an administrator, views a page displaying the submitted value, the malicious payload is executed in their browser, potentially allowing for arbitrary JavaScript execution.

Impact Assessment

The affected product is the Frontend Admin by DynamiApps WordPress plugin, with versions before 3.29.9 being vulnerable. The impact of this vulnerability includes stored cross-site scripting that can execute in the browser of any user who views a page displaying the submitted value. This can lead to unauthorized actions, data theft, or other malicious activities. The CVSS score for this vulnerability is 8.8, indicating a high severity level.

Recommended Actions

To mitigate this vulnerability, update the Frontend Admin by DynamiApps WordPress plugin to version 3.29.9 or later. Additionally, users should be cautious when viewing pages that may display user-submitted content, and consider implementing additional security measures such as Web Application Firewalls (WAFs) to detect and prevent similar attacks.

Sources

- National Vulnerability Database (NVD) - WPScan