ACF-FRONTEND-FORM-ELEMENT · CVE-2026-119504 · Package
NO FIX YET · SEE WHAT TO DO
Frontend Admin by DynamiApps, a WordPress plugin, fails to neutralize input when generating pages, which allows stored cross-site scripting. An attacker who can submit content that is later shown to other users can run scripts in their browsers.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Frontend Admin by DynamiApps WordPress plugin at version 3.30.1 or earlier are exposed. The flaw is stored XSS, so the risk is highest where the plugin lets users submit content that administrators or other visitors later view. Sites without the plugin installed are not affected.
Not affected if plugin-not-installed
Who cares acf, frontend-admin, wordpress
wp plugin list.3.30.1 is active on the site.Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Stored XSS.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.