The Frontend Admin plugin for WordPress is vulnerable to stored cross‑site scripting because the 'acff' parameter in the 'frontend_admin/forms/update_field' AJAX action is not properly sanitized or escaped. An unauthenticated attacker can submit JavaScript that is then stored in the database and will execute whenever a user loads a page containing the modified form field.

The vulnerability exists in all versions of the Frontend Admin plugin from DynamiApps up to and including 3.28.23. Any WordPress site that has installed a version in this range and is exposing the AJAX endpoint is at risk.

With a CVSS score of 7.2 the flaw is considered high severity. The EPSS score of less than 1% suggests that exploit attempts are currently rare, and it is not present in the CISA KEV catalog. Exploitation requires no privileged access; the unauthenticated AJAX endpoint can be accessed by any user, making the attack vector simple via a crafted web request.