Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-11
Frontend Admin by DynamiApps - Security Vulnerability (CVE-2026-42722)
Administrator SQL Injection in Frontend Admin by DynamiApps
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-42722
Risk Score
Threat Entry
Updated 2026-10-11
Frontend Admin by DynamiApps - Security Vulnerability (CVE-2026-6243)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'get_dynamic_values' function performing text-level find-and-replace operations on post content without HTML-aware parsing. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-6243
Risk Score
Threat Entry
Updated 2026-09-08
Frontend Admin By Dynamiapps - Authentication Bypass (CVE-2026-75816)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage…
PLUGIN
Frontend Admin By Dynamiapps
CVE-2026-75816
Risk Score
Threat Entry
Updated 2026-09-08
Frontend Admin by DynamiApps - Security Vulnerability (CVE-2026-81347)
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-81347
Risk Score
Threat Entry
Updated 2026-09-01
Frontend Admin by DynamiApps - Remote Code Execution (CVE-2026-19952)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form.
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-19952
Risk Score
Threat Entry
Updated 2026-09-01
Frontend Admin by DynamiApps - Cross-Site Scripting (XSS) (CVE-2026-12747)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-12747
Risk Score
Threat Entry
Updated 2026-08-31
Frontend Admin by DynamiApps - Broken Access Control (CVE-2026-81346)
The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans.
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-81346
Risk Score
Threat Entry
Updated 2026-10-22
Frontend Admin by DynamiApps - Cross-Site Scripting (XSS) (CVE-2026-66638)
Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-66638
Risk Score
Threat Entry
Updated 2026-08-20
Frontend Admin by DynamiApps - Privilege Escalation (CVE-2026-18432)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` authorization check behind an `is_numeric()` test, causing the check to be skipped entirely when `$user_id` is a non-numeric string — a condition that can be induced by passing a crafted value such as `1one` through the unvalidated `item_id` parameter of the unauthenticated `wp_ajax_nopriv_frontend_admin/forms/change_form` AJAX endpoint. This makes it possible for attackers to escalate privileges to administrator by obtaining a server-signed…
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-18432
Risk Score
Threat Entry
Updated 2026-08-12
Frontend Admin by DynamiApps - Broken Access Control (CVE-2026-15606)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to reset the password of any user on the site, including administrators, leading to full account takeover and complete site compromise. Exploitation requires the attacker to hold a valid encrypted Current-User token obtained by accessing any Edit User form…
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-15606
Risk Score
Threat Entry
Updated 2026-08-12
Frontend Admin by DynamiApps - Privilege Escalation (CVE-2026-66662)
Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-66662
Risk Score
Threat Entry
Updated 2026-08-12
Frontend Admin by DynamiApps - Broken Access Control (CVE-2026-66470)
Subscriber Broken Access Control in Frontend Admin by DynamiApps
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-66470
Risk Score
Threat Entry
Updated 2026-08-26
Frontend Admin by DynamiApps - Cross-Site Scripting (XSS) (CVE-2026-13609)
The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output without escaping on the Frontend Admin by DynamiApps WordPress plugin before 3.29.9's front-end display surfaces, resulting in stored cross-site scripting that executes in the browser of any user, including an administrator, who views a page displaying the submitted value.
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-13609
Risk Score
Threat Entry
Updated 2026-07-30
Frontend Admin by DynamiApps - Broken Access Control (CVE-2026-11867)
The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges (such as Subscribers) to create, rename, and delete arbitrary taxonomy terms.
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-11867
Risk Score
Threat Entry
Updated 2026-07-21
Frontend Admin by DynamiApps - SQL Injection (CVE-2026-10039)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 3.28.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires that the attacker also supply a valid 'orderby' parameter in the…
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-10039
Risk Score
Threat Entry
Updated 2026-06-17
Frontend Admin by DynamiApps - Privilege Escalation (CVE-2026-6226)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to insecure form submission handling that accepts arbitrary form definitions from user input instead of securely loading them from the backend. When $_POST['_acf_form'] is an array (rather than a form ID), the validate_form() function bypasses database lookup and directly processes the attacker-controlled structure. The create_record() function preserves attacker-supplied record data if present, and the user action's run() function falls back to attacker-controlled field definitions from $form['fields']…
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-6226
Risk Score
Threat Entry
Updated 2026-06-17
Frontend Admin by DynamiApps - Broken Access Control (CVE-2026-7802)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite an administrator's user_pass, user_email, first_name, last_name, and other profile fields by supplying an arbitrary ?user_id= value, enabling full administrator account takeover via direct password replacement or email-redirect password reset. Exploitation requires the targeted Edit-User form to have…
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-7802
Risk Score
Threat Entry
Updated 2026-06-17
Frontend Admin by DynamiApps - Privilege Escalation (CVE-2026-6228)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the admin_form post type. The admin_form custom post type uses 'capability_type' => 'page', which grants editors the ability to create and edit forms. When an editor creates an edit_user form, they can manipulate the form configuration to include 'administrator' in the role_options array by directly submitting POST data to wp-admin/post.php, bypassing…
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-6228
Risk Score
Threat Entry
Updated 2026-06-17
Frontend Admin by DynamiApps - Remote Code Execution (CVE-2026-3328)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's `maybe_unserialize()` function without class restrictions on user-controllable content stored in admin_form post content. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-3328
Risk Score
Threat Entry
Updated 2026-06-17
Frontend Admin by DynamiApps - Broken Access Control (CVE-2025-14741)
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.
PLUGIN
Frontend Admin by DynamiApps
CVE-2025-14741
Risk Score