The vulnerability is a reflected Cross‑Site Scripting (XSS) flaw. The Frontend Admin by DynamiApps plugin does not neutralize user supplied data before it is rendered in the generated page. Consequently, malicious input can be reflected back to the visitor’s browser as executable script, allowing an attacker to run arbitrary code in the victim’s session.

Affected systems are WordPress sites that use the Frontend Admin by DynamiApps plugin version 3.25.17 or earlier. The plugin, maintained by Shabti Kaplan, is referenced in the CPE as dynamiapps:frontend_admin. Any installation that has a vulnerable version is susceptible to the reflected XSS attack.

Risk and exploitability: The CVSS score of 7.1 indicates high severity. The EPSS score of less than 1% suggests a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred from the description: an attacker could craft a URL or form input containing malicious JavaScript that is then echoed back to the victim. The impact is the execution of arbitrary script in the victim’s browser. Potential secondary effects such as session hijacking or data theft are typical of XSS but are not specifically documented in the CVE description, so they are considered inferred.