Stored Cross-Site Scripting vulnerability in Frontend Admin plugin

CVE-2024-11720

What is CVE-2024-11720?

The Frontend Admin plugin by DynamiApps for WordPress is susceptible to Stored Cross-Site Scripting through submission forms, affecting all versions up to and including 3.24.5. This vulnerability arises from inadequate input sanitization and output escaping on the new Taxonomy form, enabling unauthenticated attackers to inject arbitrary scripts. When users with lower access levels are wrongly granted permissions to submit specific forms, they may unintentionally place harmful scripts that execute whenever an affected page is accessed. It is important to note that this permission configuration is disabled by default, which provides a layer of protection if not altered.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References