CVE-2026-6243

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'get_dynamic_values' function performing text-level find-and-replace operations on post content without HTML-aware parsing. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/changeset/3519460/acf-frontend-form-element
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9efd645d-817c-4148-b62f-86be90c543b4?source=cve

Published

Oct 10, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62424[This CNA information record relates to multiple CVEs; the t…5.5
• CVE-2026-62425[This CNA information record relates to multiple CVEs; the t…5.5
• CVE-2026-62426[This CNA information record relates to multiple CVEs; the t…8.8
• CVE-2026-62427[This CNA information record relates to multiple CVEs; the t…8.8
• CVE-2026-62428When grant-copy operations are processed, the respective gra…7.8
• CVE-2026-62429Accessing the vNUMA configuration data of a guest is still p…6.5
• CVE-2026-62430Accesses to the CMOS memory contents are done using an indir…7.5
• CVE-2026-62431The logic to handle periodic Viridian STIMERs performs a div…7.5
• CVE-2026-62432The EVTCHNOP_expand_array hypercall checks for whether FIFO …7.3
• CVE-2026-62433Parts of the DM_OP handling code assumes the caller has prov…7.3
• CVE-2026-62434A guest started with Populated on Demand enabled (PoD) can a…5.3
• CVE-2026-62435[This CNA information record relates to multiple CVEs; the t…6.5