A critical Stored Cross-Site Scripting vulnerability in the Frontend Admin plugin for WordPress allows unauthenticated attackers to execute arbitrary scripts in the context of a user session.

The plugin fails to properly sanitize input or escape output for the acff parameter within the frontend_admin/forms/update_field AJAX action. This flaw allows unauthenticated remote attackers to inject malicious JavaScript that executes when a victim views the affected page.

This vulnerability carries a CVSS score of 7.2, reflecting a high-severity risk due to the lack of required authentication. Successful exploitation could lead to session hijacking, unauthorized actions performed on behalf of administrative users, or the redirection of site visitors to malicious domains, causing significant reputational and operational damage.

Immediate Action: Since a specific patched version is not confirmed in the provided data, administrators should immediately deactivate and remove the Frontend Admin plugin until an official security update is verified and installed.

Proactive Monitoring: Monitor server access logs for suspicious POST requests targeting the frontend_admin/forms/update_field AJAX endpoint.

Compensating Controls: Implement a robust Web Application Firewall (WAF) rule to block unauthorized traffic containing scripts within the acff parameter.

Public Exploit Available: Unknown

Given the unauthenticated nature of this vulnerability and its potential for widespread impact on site integrity, immediate removal of the plugin is the most effective security measure. Organizations relying on this software must prioritize the identification of alternative solutions or wait for the vendor to release and document a verified patch that addresses the underlying sanitization failures.