CVE-2026-13609: Unknown Frontend Admin By Dynamiapps

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output without escaping on the Frontend Admin by DynamiApps WordPress plugin before 3.29.9's front-end display surfaces, resulting in stored cross-site scripting that executes in the browser of any user, including an administrator, who views a page displaying the submitted value.

Affected products

• Unknown Frontend Admin By Dynamiapps: before 3.29.9 (fixed in 3.29.9)

Published 2026-07-31. Last modified 2026-08-26.