Dynamiapps Frontend Admin
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Dynamiapps Frontend Admin.
By the Year
In 2026 there have been 3 vulnerabilities in Dynamiapps Frontend Admin with an average score of 5.6 out of ten. Last year, in 2025 Frontend Admin had 1 security vulnerability published. That is, 2 more vulnerabilities have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 3 | 5.57 |
| 2025 | 1 | 0.00 |
| 2024 | 4 | 7.75 |
| 2023 | 1 | 9.80 |
It may take a day or so for new Frontend Admin vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Dynamiapps Frontend Admin Security Vulnerabilities
WP Frontend Admin <3.29.13: Unauth Dir Traversal Deleting Root Files
CVE-2026-81347
5.9 - Medium
- September 04, 2026
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.
External Control of File Name or Path
Frontend Admin by DynamiApps WP Plugin 3.29.11 Unchecked Capability Deletes Plans
CVE-2026-81346
4.3 - Medium
- August 29, 2026
The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans.
AuthZ
WordPress Frontend Admin Plugin <=3.29.6 Taxonomy Cap Bypass for LowPriv Users
CVE-2026-11867
6.5 - Medium
- July 30, 2026
The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges (such as Subscribers) to create, rename, and delete arbitrary taxonomy terms.
AuthZ
Reflected XSS in DynamiApps Shabti Kaplan Frontend Admin (3.25.17)
CVE-2025-26987
- February 25, 2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Reflected XSS.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.25.17.
XSS
SQLi via 'orderby' in Frontend Admin WP Plugin <=3.25.1
CVE-2024-11722
5.9 - Medium
- December 21, 2024
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires an unauthenticated user to have been given permission to view form submissions, and the form submission shortcode be added to a page.
SQL Injection
WordPress Frontend Admin Plugin Privilege Escalation Vulnerability
CVE-2024-11721
8.1 - High
- December 14, 2024
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the 'Role' field in a form. This makes it possible for unauthenticated attackers to create new administrative user accounts, even when the administrative user role has not been provided as an option to the user, granted that unauthenticated users have been provided access to the form.
Improper Privilege Management
Stored XSS Vulnerability in Frontend Admin Plugin for WordPress
CVE-2024-11720
7.2 - High
- December 14, 2024
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms in all versions up to, and including, 3.24.5 due to insufficient input sanitization and output escaping on the new Taxonomy form. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when lower-level users have been granted access to submit specific forms, which is disabled by default.
XSS
WordPress Frontend Admin 3.19.4: Unauth Priv Esc via fea_encrypt Encryption Bypass
CVE-2024-3729
9.8 - Critical
- May 02, 2024
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can be used to add and edit administrator user for privilege escalation, or to automatically log in users for authentication bypass, or manipulate the post processing form that can be used to inject arbitrary web scripts. This can only be exploited if the 'openssl' php extension is not loaded on the server.
Failing Open
Shabti Kaplan Frontend Admin <=3.18.3 Unrestricted Upload Vulnerability
CVE-2023-51411
9.8 - Critical
- December 29, 2023
Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps.This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.
Unrestricted File Upload
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Dynamiapps Frontend Admin or by Dynamiapps? Click the Watch button to subscribe.
