Frontend Admin by DynamiApps Plugin Vulnerabilities

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Frontend Admin by DynamiApps so operators can quickly confirm whether a disclosed issue maps to the installed slug and version range.

Patch Visibility

13 records include a published patch path.

Severity Mix

5 critical and 4 high severity findings.

Reference Workflow

Jump from the hub into the full report when you need remediation notes, CVSS vector details, or source references.

Known Vulnerabilities

Reports for Frontend Admin by DynamiApps

Sorted by latest disclosure date so newly published issues surface first.

Plugin High Patched: Yes CVE-2026-3328

Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's `maybe_unserialize()` function without cl...

Published

Mar 25, 2026

Patched Release

3.28.32

Affected Versions

Versions up to 3.28.31

Next Step

Update to 3.28.32 or newer if supported.

Open Full Report Open CVE Reference

Plugin High Patched: Yes CVE-2025-14937

Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field'

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acff' parameter in the 'frontend_admin/forms/update_field' AJAX action in all versions up to, and including, 3.28.23 due to insufficient input sanitization and output escap...

Published

Jan 08, 2026

Patched Release

3.28.24

Affected Versions

Versions up to 3.28.23

Next Step

Update to 3.28.24 or newer if supported.

Open Full Report Open CVE Reference

Plugin Critical Patched: Yes CVE-2025-14741

Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for...

Published

Jan 08, 2026

Patched Release

3.28.26

Affected Versions

Versions up to 3.28.25

Next Step

Update to 3.28.26 or newer if supported.

Open Full Report Open CVE Reference

Plugin Critical Patched: Yes CVE-2025-14736

Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' fun...

Published

Jan 08, 2026

Patched Release

3.28.30

Affected Versions

Versions up to 3.28.29

Next Step

Update to 3.28.30 or newer if supported.

Open Full Report Open CVE Reference

Plugin Critical Patched: Yes CVE-2025-13342

Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handl...

Published

Dec 03, 2025

Patched Release

3.28.21

Affected Versions

Versions up to 3.28.20

Next Step

Update to 3.28.21 or newer if supported.

Open Full Report Open CVE Reference

Plugin Medium Patched: Yes CVE-2025-49267

Frontend Admin by DynamiApps <= 3.28.3 - Authenticated (Subscriber+) SQL Injection

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.28.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authe...

Published

Aug 12, 2025

Patched Release

3.28.5

Affected Versions

Versions up to 3.28.3

Next Step

Update to 3.28.5 or newer if supported.

Open Full Report Open CVE Reference

Plugin Medium Patched: Yes CVE-2025-49303

Frontend Admin by DynamiApps <= 3.28.7 - Authenticated (Editor+) Arbitrary File Deletion

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 3.28.7. This makes it possible for authenticated attackers, with Editor-level access and above, to delete...

Published

Jun 26, 2025

Patched Release

3.28.8

Affected Versions

Versions up to 3.28.7

Next Step

Update to 3.28.8 or newer if supported.

Open Full Report Open CVE Reference

Plugin Medium Patched: Yes CVE-2025-26987

Frontend Admin by DynamiApps <= 3.25.17 - Reflected Cross-Site Scripting

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.25.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

Published

Feb 23, 2025

Patched Release

3.25.18

Affected Versions

Versions up to 3.25.17

Next Step

Update to 3.25.18 or newer if supported.

Open Full Report Open CVE Reference

Plugin Medium Patched: Yes CVE-2024-11722

Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injection

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query....

Published

Dec 20, 2024

Patched Release

3.25.2

Affected Versions

Versions up to 3.25.1

Next Step

Update to 3.25.2 or newer if supported.

Open Full Report Open CVE Reference

Plugin High Patched: Yes CVE-2024-11721

Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalation

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the 'Role' field in a form. This makes it possible for unaut...

Published

Dec 13, 2024

Patched Release

3.25.1

Affected Versions

Versions up to 3.24.5

Next Step

Update to 3.25.1 or newer if supported.

Open Full Report Open CVE Reference

Plugin High Patched: Yes CVE-2024-11720

Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site Scripting

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms in all versions up to, and including, 3.24.5 due to insufficient input sanitization and output escaping on the new Taxonomy form. This makes it possible for una...

Published

Dec 13, 2024

Patched Release

3.25.1

Affected Versions

Versions up to 3.24.5

Next Step

Update to 3.25.1 or newer if supported.

Open Full Report Open CVE Reference

Plugin Critical Patched: Yes CVE-2024-3729

Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing...

Published

Apr 18, 2024

Patched Release

3.19.5

Affected Versions

Versions up to 3.19.4

Next Step

Update to 3.19.5 or newer if supported.

Open Full Report Open CVE Reference

Frontend Admin by DynamiApps Vulnerabilities

What this page helps you verify fast

Reports for Frontend Admin by DynamiApps