The Frontend Admin by DynamiApps WordPress plugin versions prior to 3.29.9 improperly handle HTML entity decoding after sanitization of form input. This flaw allows an unauthenticated attacker to submit a double-encoded payload that bypasses sanitization, resulting in stored cross-site scripting (CWE-79). When the stored payload is rendered on the front-end display surfaces of the plugin, it executes in the context of the victim's browser, potentially leading to full compromise of confidentiality, integrity, and availability for affected users.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the browsers of users who view the maliciously crafted content, including administrators. This can lead to theft of sensitive information, session hijacking, and complete compromise of the affected WordPress site’s front-end functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor form submissions and consider disabling the affected plugin if possible. Avoid viewing untrusted content submitted via the plugin’s forms.