CVE-2026-13609
Received Received - Intake

Stored XSS in Frontend Admin WordPress Plugin

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: WPScan

Description
The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output without escaping on the Frontend Admin by DynamiApps WordPress plugin before 3.29.9's front-end display surfaces, resulting in stored cross-site scripting that executes in the browser of any user, including an administrator, who views a page displaying the submitted value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-13609
EUVD
EUVD-2026-51438

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dynamiapps frontend_admin to 3.29.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Frontend Admin by DynamiApps WordPress plugin before version 3.29.9. It involves double-encoded HTML entities being decoded after sanitization, which allows malicious HTML tags to be stored and later executed as stored cross-site scripting (XSS) when viewed by users or administrators.

Detection Guidance

Check the installed version of the Frontend Admin by DynamiApps WordPress plugin. If it is below 3.29.9, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details.

Impact Analysis

An unauthenticated attacker could submit a malicious payload that executes arbitrary JavaScript in the browsers of users viewing the affected page. This could lead to session hijacking, data theft, or unauthorized actions on behalf of users, including administrators.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to user data through XSS attacks. For HIPAA, it may compromise protected health information if exploited on healthcare-related sites. Both standards require protecting user data integrity and confidentiality.

Mitigation Strategies

Update the Frontend Admin by DynamiApps WordPress plugin to version 3.29.9 or later to address the stored cross-site scripting vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart