CVE-2026-6243

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.28.37

Description The plugin is subject to Stored Cross-Site Scripting (XSS) through a kses bypass or mutation XSS. This occurs because the get dynamic values() function performs text-level find-and-replace operations on post content without using HTML-aware parsing. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update the plugin to a version newer than 3.28.36. As a temporary mitigation, restrict the ability of users with Contributor-level access to edit post content.