CVE-2026-12747: WordPress Frontend Admin XSS Vulnerability

CVE-2026-12747 Overview

CVE-2026-12747 is a stored Cross-Site Scripting (XSS) vulnerability in the Frontend Admin by DynamiApps plugin for WordPress. The flaw affects all versions up to and including 3.29.11 and stems from insufficient input sanitization and output escaping on the tag attribute of a plugin shortcode. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor who loads the affected page. The issue is tracked under CWE-79 and carries a CVSS 3.1 base score of 6.4.

Critical Impact
Authenticated contributors can persist arbitrary JavaScript into WordPress pages, enabling session theft, forced administrative actions, and drive-by redirection against every user who views the injected content.

Affected Products

Frontend Admin by DynamiApps plugin for WordPress (slug acf-frontend-form-element)
All versions up to and including 3.29.11
Fixed in version 3.29.12

Discovery Timeline

2026-09-01 - CVE-2026-12747 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-12747

Vulnerability Analysis

The Frontend Admin by DynamiApps plugin exposes a shortcode that accepts a tag attribute controlling the HTML element used to wrap rendered field output. The plugin passes this attribute into the page markup without sufficient sanitization or output escaping. An authenticated user with contributor privileges can craft a shortcode where the tag value contains attacker-controlled HTML or event handlers. When the containing post or page is rendered to any visitor, the injected script executes in that visitor's browser session.

Because the payload is stored in post content, the vulnerability is persistent. Any user viewing the page, including administrators, becomes a target. The CVSS scope change reflects the fact that JavaScript executing under the WordPress origin can act against the browser trust boundary of higher-privileged users.

Root Cause

The root cause is the plugin's failure to enforce an allow-list on the tag shortcode attribute and to escape the value before emitting it into HTML. The vulnerable code paths are visible in the plugin's shortcode and display classes, specifically in main/frontend/forms/classes/shortcodes.php around lines 818 and 839, and in main/frontend/forms/classes/display.php around lines 1791 and 1810. See the WordPress ACF Shortcodes Class source for the pre-patch implementation.

Attack Vector

An attacker first obtains a WordPress account with contributor-level access or higher. This is a common privilege tier on multi-author sites and can also be reached through open registration or account takeover. The attacker then creates or edits a post that embeds the vulnerable Frontend Admin shortcode, supplying a malicious tag attribute containing script content or HTML with event handlers. Once the post is rendered, the payload executes in every visitor's browser, allowing cookie theft, forced administrative requests via CSRF token replay, and arbitrary DOM manipulation.

Exploitation requires no user interaction beyond viewing the injected page. No verified public proof-of-concept code has been published; refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-12747

Indicators of Compromise

Post or page content containing Frontend Admin shortcodes where the tag attribute includes <, >, on*= event handlers, or javascript: URIs.
Outbound browser requests from site visitors to unexpected third-party domains shortly after page load.
New or modified wp_posts rows authored by contributor-level accounts that contain unusual shortcode attributes.
Administrator sessions performing unexpected privileged actions immediately after viewing content authored by lower-privileged users.

Detection Strategies

Query the WordPress database for posts containing Frontend Admin shortcodes and inspect all tag= attribute values for non-alphanumeric characters.
Deploy a web application firewall rule that inspects shortcode attributes in POST bodies sent to /wp-admin/post.php and /wp-json/wp/v2/posts.
Monitor content security policy (CSP) violation reports for inline script executions originating from post content.
Review contributor and author account activity logs for post creation patterns that correlate with subsequent administrator anomalies.

Monitoring Recommendations

Enable WordPress audit logging for post create, update, and shortcode-render events.
Alert on any HTTP response from the site containing script fragments inside attributes of plugin-rendered wrappers.
Track authentication events for contributor accounts, particularly logins from new IP addresses or geographies.
Baseline the plugin version across all WordPress instances and alert when any host reports a version at or below 3.29.11.

How to Mitigate CVE-2026-12747

Immediate Actions Required

Upgrade the Frontend Admin by DynamiApps plugin to version 3.29.12 or later on every WordPress instance.
Audit all posts and pages that use Frontend Admin shortcodes and remove any tag attribute values containing HTML metacharacters.
Review and, where possible, reduce the number of accounts holding contributor-level or higher privileges.
Force a password reset and session invalidation for any account suspected of injecting malicious content.

Patch Information

The vendor addressed the vulnerability in version 3.29.12 of the Frontend Admin by DynamiApps plugin. The corrected implementation is available in the WordPress plugin repository. Administrators should install the update through the WordPress plugin management interface or via WP-CLI on every affected site.

Workarounds

If immediate patching is not possible, disable the Frontend Admin by DynamiApps plugin until the upgrade can be applied.
Restrict content publishing permissions so that only trusted editor and administrator accounts can create or edit posts.
Deploy a web application firewall rule to block shortcode attributes containing angle brackets, event handlers, or javascript: schemes.
Enforce a strict Content Security Policy that disallows inline script execution on public-facing pages.

bash

# Configuration example: upgrade the plugin using WP-CLI
wp plugin update acf-frontend-form-element --version=3.29.12
wp plugin list --name=acf-frontend-form-element --fields=name,status,version