CVE-2026-119504: WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Stored XSS.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Frontend Admin by DynamiAppsto a version that resolves this vulnerability.Fixed in 3.30.2
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must be able to induce a user to interact with crafted content or functionality, as indicated by the required user interaction. No authentication is required for the attacker.
What is the potential impact if exploitation succeeds?
Successful exploitation can result in stored cross-site scripting and may affect confidentiality, integrity, and availability with low impact. The scope can extend beyond the vulnerable plugin's security authority.
Which plugin versions are affected?
Frontend Admin by DynamiApps is affected through version 3.30.1. The provided data does not identify a fixed version.