{"id":"CVE-2026-119504","kind":"vulnerability","aliases":["CVE-2026-119504"],"related":[],"title":"Frontend Admin WordPress plugin: stored XSS through versions up to 3.30.1","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Stored XSS.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.","summary":"Frontend Admin by DynamiApps, a WordPress plugin, fails to neutralize input when generating pages, which allows stored cross-site scripting. An attacker who can submit content that is later shown to other users can run scripts in their browsers.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"acf-frontend-form-element","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["acf","frontend-admin","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Frontend Admin by DynamiApps plugin (acf-frontend-form-element) in the WordPress plugins screen, or in `wp plugin list`.\n- Confirm whether any version up to and including `3.30.1` is active on the site.","fix":"- Frontend Admin by DynamiApps: unknown (the sources do not name a fixed version)","status":"open","published_at":"2026-11-09T10:17:06+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","triaged_at":"2026-11-09T10:26:19+00:00","updated_at":"2026-11-09T10:26:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T10:26:19Z","model":"claude-haiku-5-5","output":{"fix":"- Frontend Admin by DynamiApps: unknown (the sources do not name a fixed version)","reach":"internet","title":"Frontend Admin WordPress plugin: stored XSS through versions up to 3.30.1","impact":"medium","summary":"Frontend Admin by DynamiApps, a WordPress plugin, fails to neutralize input when generating pages, which allows stored cross-site scripting. An attacker who can submit content that is later shown to other users can run scripts in their browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","frontend-admin","acf"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in victims' browsers, possibly including administrators.","analyst_note":"Find the fixed version and the required privilege level for the Frontend Admin by DynamiApps plugin in the NVD entry or the vendor changelog.","how_to_check":"- Check the installed version of the Frontend Admin by DynamiApps plugin (acf-frontend-form-element) in the WordPress plugins screen, or in `wp plugin list`.\n- Confirm whether any version up to and including `3.30.1` is active on the site.","plain_action":"","product_name":"acf-frontend-form-element","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Frontend Admin by DynamiApps WordPress plugin at version 3.30.1 or earlier are exposed. The flaw is stored XSS, so the risk is highest where the plugin lets users submit content that administrators or other visitors later view. Sites without the plugin installed are not affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000778,"input_tokens":4567,"output_tokens":642,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119504':14A,17A '-2026':13A,16A '3.30.1':11A,105C 'acf':19A,23B,89C 'acf-frontend-form-el':88C 'acf-frontend-form-element':18A 'admin':2A,26B,30B,85C,99C 'affect':97C 'allow':44B,93C 'attack':51B 'browser':68B 'content':55B 'cross':47B,78C 'cross-sit':46B,77C 'cve':12A,15A 'dynamiapp':32B,83C,87C,101C 'element':22A,92C 'fail':36B 'form':21A,91C 'frontend':1A,20A,25B,29B,84C,90C,98C 'frontend-admin':24B 'generat':41B,76C 'improp':69C 'input':39B,72C 'issu':96C 'later':58B 'n/a':103C 'neutral':38B,70C 'packag':27B 'page':42B,75C 'plugin':4A,35B 'run':64B 'script':49B,65B,80C 'shown':59B 'site':48B,79C 'store':5A,45B,94C 'submit':54B 'user':62B 'version':8A 'vulner':81C 'web':74C 'wordpress':3A,28B,34B 'xss':6A 'xss.this':95C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Frontend Admin by DynamiApps WordPress plugin at version 3.30.1 or earlier are exposed. The flaw is stored XSS, so the risk is highest where the plugin lets users submit content that administrators or other visitors later view. Sites without the plugin installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["acffrontendformelement"],"ptokens":["acf","element","form","frontend"],"labels":["acf","frontendadmin","high","package","vendor","wordpress"],"campaign_type":null,"search_a":"'-119504':14A,17A '-2026':13A,16A '3.30.1':11A 'acf':19A 'acf-frontend-form-element':18A 'admin':2A 'cve':12A,15A 'element':22A 'form':21A 'frontend':1A,20A 'plugin':4A 'store':5A 'version':8A 'wordpress':3A 'xss':6A","search_b":"'acf':23B 'admin':26B,30B 'allow':44B 'attack':51B 'browser':68B 'content':55B 'cross':47B 'cross-sit':46B 'dynamiapp':32B 'fail':36B 'frontend':25B,29B 'frontend-admin':24B 'generat':41B 'input':39B 'later':58B 'neutral':38B 'packag':27B 'page':42B 'plugin':35B 'run':64B 'script':49B,65B 'shown':59B 'site':48B 'store':45B 'submit':54B 'user':62B 'wordpress':28B,34B","search_c":"'3.30.1':105C 'acf':89C 'acf-frontend-form-el':88C 'admin':85C,99C 'affect':97C 'allow':93C 'cross':78C 'cross-sit':77C 'dynamiapp':83C,87C,101C 'element':92C 'form':91C 'frontend':84C,90C,98C 'generat':76C 'improp':69C 'input':72C 'issu':96C 'n/a':103C 'neutral':70C 'page':75C 'script':80C 'site':79C 'store':94C 'vulner':81C 'web':74C 'xss.this':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119504","severity":null,"published_at":"2026-11-09T10:17:06+00:00","modified_at":"2026-11-09T10:17:06+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","fetched_at":"2026-11-09T10:25:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}