VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 17 known issues Latest disclosed May 28, 2026

Frontend Admin by DynamiApps Vulnerabilities

Review known vulnerability records for the WordPress plugin Frontend Admin by DynamiApps (`acf-frontend-form-element`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-10039, CVE-2026-7802 and CVE-2026-6226, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
17
High or Critical
12
Patch Coverage
100%
Last Updated
May 29, 2026
Related Security Guides

Use these guides while reviewing Frontend Admin by DynamiApps fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize Frontend Admin by DynamiApps remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
17
1. Match the Package
Confirm the installed WordPress plugin slug is acf-frontend-form-element before acting on any CVE from this cluster.
2. Sort by Severity
Start with 12 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
17 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2025-14736 Critical
Privilege Escalation remediation for Frontend Admin by DynamiApps

Affected range: Versions up to 3.28.29. Fixed version: 3.28.30.

CVE-2025-13342 Critical
Vulnerability remediation for Frontend Admin by DynamiApps

Affected range: Versions up to 3.28.20. Fixed version: 3.28.21.

CVE-2024-3729 Critical
Privilege Escalation remediation for Frontend Admin by DynamiApps

Affected range: Versions up to 3.19.4. Fixed version: 3.19.5.

CVE-2023-51411 Critical
Remote Code Execution remediation for Frontend Admin by DynamiApps

Affected range: Versions up to 3.18.3. Fixed version: 3.18.4.

Priority CVE Quick Links

Fast paths into Frontend Admin by DynamiApps CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
17
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2025-14736
Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Ad...
 Privilege Escalation Versions up to 3.28.29 3.28.30 CVSS 9.8
CVE-2025-13342
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
 Vulnerability Versions up to 3.28.20 3.28.21 CVSS 9.8
CVE-2024-3729
Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handl...
 Privilege Escalation Versions up to 3.19.4 3.19.5 CVSS 9.8
CVE-2023-51411
Frontend Admin by DynamiApps Plugin <= 3.18.3 - Unauthenticated Arbitrary File Uploa...
 Remote Code Execution Versions up to 3.18.3 3.18.4 CVSS 9.8
CVE-2025-14741
Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated A...
 Vulnerability Versions up to 3.28.25 3.28.26 CVSS 9.1
CVE-2026-7802
Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Sub...
 Authorization Bypass Versions up to 3.29.2 3.29.3 CVSS 8.8
CVE-2026-6226
Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Fo...
 Privilege Escalation Versions up to 3.29.2 3.29.3 CVSS 8.8
CVE-2026-6228
Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via E...
 Privilege Escalation Versions up to 3.28.36 3.29.1 CVSS 8.8
CVE-2025-14736 Critical 3.28.30
CVE-2025-14736 Frontend Admin by DynamiApps Privilege Escalation

Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field

CVE-2025-13342 Critical 3.28.21
CVE-2025-13342 Frontend Admin by DynamiApps Vulnerability

Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update

CVE-2024-3729 Critical 3.19.5
CVE-2024-3729 Frontend Admin by DynamiApps Privilege Escalation

Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation

CVE-2023-51411 Critical 3.18.4
CVE-2023-51411 Frontend Admin by DynamiApps Remote Code Execution

Frontend Admin by DynamiApps Plugin <= 3.18.3 - Unauthenticated Arbitrary File Upload

CVE-2025-14741 Critical 3.28.26
CVE-2025-14741 Frontend Admin by DynamiApps Vulnerability

Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element

CVE-2026-7802 High 3.29.3
CVE-2026-7802 Frontend Admin by DynamiApps Authorization Bypass

Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter

CVE-2026-6226 High 3.29.3
CVE-2026-6226 Frontend Admin by DynamiApps Privilege Escalation

Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection

CVE-2026-6228 High 3.29.1
CVE-2026-6228 Frontend Admin by DynamiApps Privilege Escalation

Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for Frontend Admin by DynamiApps so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
17 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
5 critical and 7 high severity findings.
Recent CVEs
CVE-2026-10039, CVE-2026-7802 and CVE-2026-6226
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Frontend Admin by DynamiApps

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-10039
CVE-2026-10039: Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 3.28.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

Published
May 28, 2026
Patched Release
3.28.29
Affected Versions
Versions up to 3.28.8
Next Step
Update to 3.28.29 or newer if supported.
Review CVE-2026-10039 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2026-7802
CVE-2026-7802: Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated atta...

Published
May 27, 2026
Patched Release
3.29.3
Affected Versions
Versions up to 3.29.2
Next Step
Update to 3.29.3 or newer if supported.
Review CVE-2026-7802 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2026-6226
CVE-2026-6226: Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to insecure form submission handling that accepts arbitrary form definitions from user input instead of securely loading...

Published
May 27, 2026
Patched Release
3.29.3
Affected Versions
Versions up to 3.29.2
Next Step
Update to 3.29.3 or newer if supported.
Review CVE-2026-6226 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2026-6228
CVE-2026-6228: Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the admin_form...

Published
May 14, 2026
Patched Release
3.29.1
Affected Versions
Versions up to 3.28.36
Next Step
Update to 3.29.1 or newer if supported.
Review CVE-2026-6228 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2026-3328
CVE-2026-3328: Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's `maybe_unserialize()` function without cl...

Published
Mar 25, 2026
Patched Release
3.28.32
Affected Versions
Versions up to 3.28.31
Next Step
Update to 3.28.32 or newer if supported.
Review CVE-2026-3328 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-14937
CVE-2025-14937: Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field'

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acff' parameter in the 'frontend_admin/forms/update_field' AJAX action in all versions up to, and including, 3.28.23 due to insufficient input sanitization and output escap...

Published
Jan 08, 2026
Patched Release
3.28.24
Affected Versions
Versions up to 3.28.23
Next Step
Update to 3.28.24 or newer if supported.
Review CVE-2025-14937 fixed version details Open CVE Reference
Plugin Critical Patched: Yes CVE-2025-14741
CVE-2025-14741: Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for...

Published
Jan 08, 2026
Patched Release
3.28.26
Affected Versions
Versions up to 3.28.25
Next Step
Update to 3.28.26 or newer if supported.
Review CVE-2025-14741 fixed version details Open CVE Reference
Plugin Critical Patched: Yes CVE-2025-14736
CVE-2025-14736: Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' fun...

Published
Jan 08, 2026
Patched Release
3.28.30
Affected Versions
Versions up to 3.28.29
Next Step
Update to 3.28.30 or newer if supported.
Review CVE-2025-14736 fixed version details Open CVE Reference
Plugin Critical Patched: Yes CVE-2025-13342
CVE-2025-13342: Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handl...

Published
Dec 03, 2025
Patched Release
3.28.21
Affected Versions
Versions up to 3.28.20
Next Step
Update to 3.28.21 or newer if supported.
Review CVE-2025-13342 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-49267
CVE-2025-49267: Frontend Admin by DynamiApps <= 3.28.3 - Authenticated (Subscriber+) SQL Injection

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.28.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authe...

Published
Aug 12, 2025
Patched Release
3.28.5
Affected Versions
Versions up to 3.28.3
Next Step
Update to 3.28.5 or newer if supported.
Review CVE-2025-49267 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-49303
CVE-2025-49303: Frontend Admin by DynamiApps <= 3.28.7 - Authenticated (Editor+) Arbitrary File Deletion

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 3.28.7. This makes it possible for authenticated attackers, with Editor-level access and above, to delete...

Published
Jun 26, 2025
Patched Release
3.28.8
Affected Versions
Versions up to 3.28.7
Next Step
Update to 3.28.8 or newer if supported.
Review CVE-2025-49303 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-26987
CVE-2025-26987: Frontend Admin by DynamiApps <= 3.25.17 - Reflected Cross-Site Scripting

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.25.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

Published
Feb 23, 2025
Patched Release
3.25.18
Affected Versions
Versions up to 3.25.17
Next Step
Update to 3.25.18 or newer if supported.
Review CVE-2025-26987 fixed version details Open CVE Reference