Frontend Admin by DynamiApps (<= 3.30.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/frontend-admin-by-dynamiapps--3.30.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 11:39:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFrontend Admin by DynamiApps: Stored Cross-site Scripting (CVE-2026-119504)https://feed.craftedsignal.io/briefs/2026-11-cve-2026-119504/Mon, 09 Nov 2026 11:39:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-119504/The Frontend Admin by DynamiApps plugin for WordPress contains a stored cross-site scripting vulnerability in the acf-frontend-form-element component that allows attackers to inject malicious scripts.Frontend Admin by DynamiApps is vulnerable to stored Cross-site Scripting (XSS) due to improper input neutralization during web page generation. The vulnerability exists in the acf-frontend-form-element component. Affected versions include all versions from n/a through 3.30.1.

Impact

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of an affected user session, potentially leading to unauthorized actions or session hijacking.

Recommendation

  • Upgrade Frontend Admin by DynamiApps to a version beyond 3.30.1 to address the underlying input neutralization flaw.
  • Review WordPress audit logs for unexpected modifications to forms or pages containing the acf-frontend-form-element component.
  • Audit custom content stored through the affected plugin for malicious script tags or event handlers.
]]>highadvisory