A flaw in the Frontend Admin by DynamiApps WordPress plugin, present in versions prior to 3.29.9, allows an attacker to submit a double‑encoded payload via a publicly accessible form field. The plugin sanitizes input but later decodes HTML entities, re‑introducing tags that were neutralized. The result is that the payload is stored and rendered as live HTML on the site, where it executes as JavaScript in the browsers of any user who views the page, including administrators.

Any WordPress installation using Frontend Admin by DynamiApps plugin versions earlier than 3.29.9 is affected. The vulnerability resides in the plugin’s front‑end form handling and display components.

The attack vector is unauthenticated user input; an attacker only requires the ability to reach the form page. Because the script is stored and displayed to all visitors, the impact is broad, potentially affecting all site users. The CVSS score is 8.8, indicating high severity. The EPSS score is less than 1%, indicating a low yet non-zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Without mitigation, any user visiting a page that displays the stored value could have arbitrary code executed in their browser context, including administrators who manage the site.