PT-2026-1758 · Dynamiapps+1 · Frontend Admin By Dynamiapps+1

Paolo Tresso · CVE-2025-14937 · Published 2026-01-09 · Updated 2026-01-09

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions up to and including 3.28.23

Description The Frontend Admin by DynamiApps plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping in the acff parameter within the 'frontend admin/forms/update field' API Endpoint. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute when a user accesses the injected page. The vulnerable parameter is acff.

Recommendations Versions prior to 3.28.23 should be updated to a later version.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-14937

Affected Products

Frontend Admin

Frontend Admin By Dynamiapps

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14937 · Security Note
• https://twitter.com/VulmonFeeds/status/2009554410171511116 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/46c988ff-9cc5-4f2b-a3dd-06eaef5a7919?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3427236/acf-frontend-form-element · Note
• https://t.me/CVEtracker/41801 · Telegram Post
• https://twitter.com/CVEnew/status/2009532266960310389 · Twitter Post