6 matches found
CVE-2026-6243
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...
CVE-2026-6243 Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...
CVE-2026-6243
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.28.36 . The root cause is the get_dynamic_values function, which performs text-level find-and-replace operations on post content without utilizing HTML-aw...
EUVD-2026-96213
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...
CVE-2026-6243: Improper Neutralization of Input During Web Page Generation
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...
WordPress ACF Frontend Admin by DynamiApps: Cross-site Script Vulnerability
WordPress ACF Frontend Admin by DynamiApps version 3.28.36 and earlier has a cross-site scripting vulnerability. This vulnerability stems from the getdynamicvalues function’s text-level search and replacement operation on content, without proper HTML parsing. As a result, authenticated attackers...