Frontend Admin by DynamiApps: Stored Cross-site Scripting (CVE-2026-119504)
The Frontend Admin by DynamiApps plugin for WordPress contains a stored cross-site scripting vulnerability in the acf-frontend-form-element component that allows attackers to inject malicious scripts.
CVE search metadata
CVE search record: CVE-2026-119504. Severity: high. CVSS: 7.1. KEV: no. Product: Frontend Admin by DynamiApps (<= 3.30.1). Brief: Frontend Admin by DynamiApps: Stored Cross-site Scripting (CVE-2026-119504). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-119504/
Triage facts
Revision 1- Applicability
- Frontend Admin by DynamiApps (<= 3.30.1)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 11:39 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Frontend Admin by DynamiApps is vulnerable to stored Cross-site Scripting (XSS) due to improper input neutralization during web page generation. The vulnerability exists in the acf-frontend-form-element component. Affected versions include all versions from n/a through 3.30.1.
Impact
Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of an affected user session, potentially leading to unauthorized actions or session hijacking.
Recommendation
- Upgrade Frontend Admin by DynamiApps to a version beyond 3.30.1 to address the underlying input neutralization flaw.
- Review WordPress audit logs for unexpected modifications to forms or pages containing the acf-frontend-form-element component.
- Audit custom content stored through the affected plugin for malicious script tags or event handlers.
Immediate actions
Upgrade Frontend Admin by DynamiApps to version > 3.30.1
Threat Hunt
Identify stored XSS payloads in plugin-managed form elements
Data: WordPress database table content for plugin-related metadata, Web access logs for administrative POST requests to plugin endpoints
Mitigations
Upgrade affected WordPress plugin
CVE-2026-119504