Double-Encoded Payload Bypass Enables Stored XSS in WordPress Admin Plugin

The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output without escaping on the Frontend Admin by DynamiApps WordPress plugin before 3.29.9's front-end display surfaces, resulting in stored cross-site scripting that executes in the browser of any user, including an administrator, who views a page displaying the submitted value.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-13609 is a stored cross-site scripting (XSS) vulnerability in the Frontend Admin by DynamiApps WordPress plugin that exploits a dangerous sanitization-then-decode pattern. An unauthenticated attacker can submit a double-encoded HTML payload through a form field. The plugin sanitizes the input to neutralize tags, but then decodes HTML entities afterward—restoring the very tags the sanitizer just blocked. This stored payload executes when displayed on the front-end without proper output escaping, allowing attackers to steal session tokens, redirect users, deface content, or harvest credentials. Any WordPress site running the vulnerable plugin version (before 3.29.9) that allows unauthenticated form submissions is at risk, affecting site visitors and administrative users alike.

Casky's 322 mapped security skills detect this attack pattern across MITRE ATT&CK's Initial Access (TA0001) and Credential Access (TA0043) techniques by identifying the characteristic signature: unsanitized HTML entity decoding following input validation. Claude's extended reasoning engine recognizes the logical flaw in the sanitization-decode sequence and correlates it with common XSS payloads that exploit encoding bypasses. Practitioners using Casky will see findings highlighting the vulnerability chain—detecting where form inputs flow through inadequate sanitization logic, where entity decoding occurs post-validation, and where output escaping is missing. The platform flags the specific risk: unauthenticated access combined with stored persistence, marking this as a high-confidence indicator of exploitable XSS with attack readiness score elevated by active weaponization patterns in the threat landscape.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13609.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-13609

Casky has 322 skills that investigate the attack patterns behind CVE-2026-13609. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn