Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-09
Acf Frontend Form Element - Security Vulnerability (CVE-2026-119504)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Stored XSS.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.
PLUGIN
Acf Frontend Form Element
CVE-2026-119504
Risk Score
Threat Entry
Updated 2026-11-09
Acf Frontend Form Element - Security Vulnerability (CVE-2026-119506)
Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.
PLUGIN
Acf Frontend Form Element
CVE-2026-119506
Risk Score
Threat Entry
Updated 2026-10-11
Acf Frontend Form Element - Security Vulnerability (CVE-2026-42722)
Administrator SQL Injection in Frontend Admin by DynamiApps
PLUGIN
Acf Frontend Form Element
CVE-2026-42722
Risk Score
Threat Entry
Updated 2026-10-11
Acf Frontend Form Element - Security Vulnerability (CVE-2026-6243)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'get_dynamic_values' function performing text-level find-and-replace operations on post content without HTML-aware parsing. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Acf Frontend Form Element
CVE-2026-6243
Risk Score
Threat Entry
Updated 2026-09-08
Acf Frontend Form Element - Authentication Bypass (CVE-2026-75816)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage…
PLUGIN
Acf Frontend Form Element
CVE-2026-75816
Risk Score
Threat Entry
Updated 2026-09-01
Acf Frontend Form Element - Remote Code Execution (CVE-2026-19952)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form.
PLUGIN
Acf Frontend Form Element
CVE-2026-19952
Risk Score
Threat Entry
Updated 2026-09-01
Acf Frontend Form Element - Cross-Site Scripting (XSS) (CVE-2026-12747)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Acf Frontend Form Element
CVE-2026-12747
Risk Score
Threat Entry
Updated 2026-10-22
Acf Frontend Form Element - Cross-Site Scripting (XSS) (CVE-2026-66638)
Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps
PLUGIN
Acf Frontend Form Element
CVE-2026-66638
Risk Score
Threat Entry
Updated 2026-08-20
Acf Frontend Form Element - Privilege Escalation (CVE-2026-18432)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` authorization check behind an `is_numeric()` test, causing the check to be skipped entirely when `$user_id` is a non-numeric string — a condition that can be induced by passing a crafted value such as `1one` through the unvalidated `item_id` parameter of the unauthenticated `wp_ajax_nopriv_frontend_admin/forms/change_form` AJAX endpoint. This makes it possible for attackers to escalate privileges to administrator by obtaining a server-signed…
PLUGIN
Acf Frontend Form Element
CVE-2026-18432
Risk Score
Threat Entry
Updated 2026-08-12
Acf Frontend Form Element - Broken Access Control (CVE-2026-15606)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to reset the password of any user on the site, including administrators, leading to full account takeover and complete site compromise. Exploitation requires the attacker to hold a valid encrypted Current-User token obtained by accessing any Edit User form…
PLUGIN
Acf Frontend Form Element
CVE-2026-15606
Risk Score
Threat Entry
Updated 2026-07-21
Acf Frontend Form Element - SQL Injection (CVE-2026-10039)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 3.28.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires that the attacker also supply a valid 'orderby' parameter in the…
PLUGIN
Acf Frontend Form Element
CVE-2026-10039
Risk Score
Threat Entry
Updated 2026-06-17
Acf Frontend Form Element - Privilege Escalation (CVE-2026-6226)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to insecure form submission handling that accepts arbitrary form definitions from user input instead of securely loading them from the backend. When $_POST['_acf_form'] is an array (rather than a form ID), the validate_form() function bypasses database lookup and directly processes the attacker-controlled structure. The create_record() function preserves attacker-supplied record data if present, and the user action's run() function falls back to attacker-controlled field definitions from $form['fields']…
PLUGIN
Acf Frontend Form Element
CVE-2026-6226
Risk Score
Threat Entry
Updated 2026-06-17
Acf Frontend Form Element - Broken Access Control (CVE-2026-7802)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite an administrator's user_pass, user_email, first_name, last_name, and other profile fields by supplying an arbitrary ?user_id= value, enabling full administrator account takeover via direct password replacement or email-redirect password reset. Exploitation requires the targeted Edit-User form to have…
PLUGIN
Acf Frontend Form Element
CVE-2026-7802
Risk Score
Threat Entry
Updated 2026-06-17
Acf Frontend Form Element - Privilege Escalation (CVE-2026-6228)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the admin_form post type. The admin_form custom post type uses 'capability_type' => 'page', which grants editors the ability to create and edit forms. When an editor creates an edit_user form, they can manipulate the form configuration to include 'administrator' in the role_options array by directly submitting POST data to wp-admin/post.php, bypassing…
PLUGIN
Acf Frontend Form Element
CVE-2026-6228
Risk Score
Threat Entry
Updated 2026-06-17
Acf Frontend Form Element - Remote Code Execution (CVE-2026-3328)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's `maybe_unserialize()` function without class restrictions on user-controllable content stored in admin_form post content. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
PLUGIN
Acf Frontend Form Element
CVE-2026-3328
Risk Score
Threat Entry
Updated 2026-06-17
Acf Frontend Form Element - Broken Access Control (CVE-2025-14741)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.
PLUGIN
Acf Frontend Form Element
CVE-2025-14741
Risk Score
Threat Entry
Updated 2026-06-17
Acf Frontend Form Element - Cross-Site Scripting (XSS) (CVE-2025-14937)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acff' parameter in the 'frontend_admin/forms/update_field' AJAX action in all versions up to, and including, 3.28.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Acf Frontend Form Element
CVE-2025-14937
Risk Score
Threat Entry
Updated 2026-06-17
Acf Frontend Form Element - Privilege Escalation (CVE-2025-14736)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for unauthenticated attackers to register as administrators and gain complete control of the site, granted they can access a user registration form containing a Role field.
PLUGIN
Acf Frontend Form Element
CVE-2025-14736
Risk Score
Threat Entry
Updated 2026-06-17
Acf Frontend Form Element - Security Vulnerability (CVE-2025-13342)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handler. This makes it possible for unauthenticated attackers to modify critical WordPress options such as users_can_register, default_role, and admin_email via submitting crafted form data to public frontend forms.
PLUGIN
Acf Frontend Form Element
CVE-2025-13342
Risk Score
Threat Entry
Updated 2026-06-17
Acf Frontend Form Element - SQL Injection (CVE-2025-49267)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Blind SQL Injection.This issue affects Frontend Admin by DynamiApps: from n/a through
PLUGIN
Acf Frontend Form Element
CVE-2025-49267
Risk Score