CVE-2025-26987 WordPress Frontend Admin by DynamiApps plugin <= 3.25.17 - Reflected Cross Site Scripting (XSS) vulnerability

What is CVE-2025-26987?

CVE-2025-26987 is a high-severity cross-site scripting vulnerability in Shabti Kaplan Frontend Admin by DynamiApps, published on 25 Feb 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Reflected XSS.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.25.17.

Weakness: CWE-79

Which versions are affected by CVE-2025-26987?

It affects 1 product.

Products include Dynamiapps Frontend Admin.

How do I fix CVE-2025-26987?

No fix has been published for CVE-2025-26987 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-26987 being exploited?

There is no known exploitation of CVE-2025-26987 in the wild and no public exploit code.

Other vulnerabilities in Shabti Kaplan Frontend Admin by DynamiApps

• CVE-2023-51411 WordPress Frontend Admin by DynamiApps Plugin <= 3.18.3 is vulnerable to Arbitrary File Upload Critical 10.0
• CVE-2024-3729 Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation Critical 9.8
• CVE-2024-11721 Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalation High 8.1
• CVE-2024-11720 Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site Scripting High 7.2
• CVE-2024-11722 Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injection Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pp8v-4g4g-j2pg.