The vulnerability is a contributor-based cross‑site scripting flaw in the Frontend Admin by DynamiApps plugin, with affected releases up to and including 3.29.10. An attacker can inject malicious script payloads into fields that are improperly sanitized when rendered in the browser. This can lead to session hijacking, cookie theft, defacement, or other client‑side compromise. The weakness is classified under CWE‑79 and represents a classic XSS vector that can impact confidentiality, integrity, and user trust.

The flaw affects WordPress sites using the Shabti Kaplan:Frontend Admin by DynamiApps plugin with versions 3.29.10 or earlier. Site administrators should verify whether the plugin is installed and identify the specific version. Vendors do not list a public patch in the input; however, the latest version of the plugin is 3.29.11 and newer contains the fix. Sites that can’t upgrade should consider disabling or removing the plugin until a secure update is available.

The CVSS score of 6.5 indicates moderate severity, but the EPSS score is currently not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The most likely attack vector is through the plugin’s front‑end administrative interface where user input is rendered in the browser. While exploitation requires the ability to craft injected content that reaches the victim’s browser, the lack of active exploitation evidence and moderate score mean that the risk is present but not immediately critical. Nonetheless, the presence of an XSS flaw invites any additional risk of credential theft or malware distribution.