Stored Cross-Site Scripting vulnerability in Frontend Admin plugin

CVE-2024-11720

Summary

The Frontend Admin plugin by DynamiApps for WordPress is susceptible to Stored Cross-Site Scripting through submission forms, affecting all versions up to and including 3.24.5. This vulnerability arises from inadequate input sanitization and output escaping on the new Taxonomy form, enabling unauthenticated attackers to inject arbitrary scripts. When users with lower access levels are wrongly granted permissions to submit specific forms, they may unintentionally place harmful scripts that execute whenever an affected page is accessed. It is important to note that this permission configuration is disabled by default, which provides a layer of protection if not altered.

References