CVE-2024-11720 is a stored cross-site scripting vulnerability (CWE-79) in the Frontend Admin by DynamiApps plugin for WordPress, affecting all versions up to and including 3.24.5. The issue is due to improper neutralization of input during web page generation on the new Taxonomy submission form, enabling unauthenticated attackers to inject arbitrary web scripts that execute when a user views the injected page. Exploitation depends on lower-level user permissions to submit forms, which are disabled by default. The vulnerability has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with scope change.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, potentially leading to arbitrary script execution in the context of users viewing the affected pages. This can result in information disclosure and integrity impacts. However, exploitation requires that lower-level users have form submission permissions enabled, which is not the default configuration. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability depends on lower-level user permissions to submit forms, ensure that such permissions remain disabled if not required. Monitor for vendor updates or patches addressing this issue and apply them promptly once available.