PT-2026-1758 · Dynamiapps+1 · Frontend Admin By Dynamiapps+1

Paolo Tresso · Publicado 2026-01-09 · Atualizado 2026-01-09 · CVE-2025-14937

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions up to and including 3.28.23

Description The Frontend Admin by DynamiApps plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping in the acff parameter within the 'frontend admin/forms/update field' API Endpoint. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute when a user accesses the injected page. The vulnerable parameter is acff.

Recommendations Versions prior to 3.28.23 should be updated to a later version.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-14937

Produtos afetados

Frontend Admin

Frontend Admin By Dynamiapps

Referências · 6

• https://twitter.com/VulmonFeeds/status/2009554410171511116 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14937 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/46c988ff-9cc5-4f2b-a3dd-06eaef5a7919?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset/3427236/acf-frontend-form-element · Nota
• https://t.me/CVEtracker/41801 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2009532266960310389 · Publicação no Twitter