Shabti Frontend Admin By Dynamiapps vulnerabilities

CVE-2025-13342 [CRITICAL] CWE-862 CVE-2025-13342: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handler. This makes it possible for unauthenticated attackers to modify cri

CVE-2022-4974 [MEDIUM] CWE-862 CVE-2022-4974: The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cr The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme runni

CVE-2025-14736 [CRITICAL] CWE-269 CVE-2025-14736: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all v The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for unauthenticated attackers to regis

CVE-2024-3729 [CRITICAL] CWE-636 CVE-2024-3729: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption e The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can be used to add and edit administrator user for privil

CVE-2026-6226 [HIGH] CWE-269 CVE-2026-6226: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege esc The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to insecure form submission handling that accepts arbitrary form definitions from user input instead of securely loading them from the backend. When $_POST['_acf_form'] is an array (rather than a

CVE-2025-14741 [CRITICAL] CWE-862 CVE-2025-14741: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unau The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for unauthenticated attackers to delete arbitrary posts, pages, products,

CVE-2026-6228 [HIGH] CWE-269 CVE-2026-6228: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versi The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the admin_form post type. The admin_form custom post type uses 'capability_type' => 'page

CVE-2026-7802 [HIGH] CWE-862 CVE-2026-7802: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all v The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite an administrato

CVE-2024-11721 [HIGH] CWE-269 CVE-2024-11721: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all v The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the 'Role' field in a form. This makes it possible for unauthenticated attackers to create new administrative user accounts, even whe

CVE-2026-3328 [HIGH] CWE-502 CVE-2026-3328: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via dese The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's `maybe_unserialize()` function without class restrictions on user-controllable content stored in admin_form post con

CVE-2025-14937 [HIGH] CWE-79 CVE-2025-14937: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting v The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acff' parameter in the 'frontend_admin/forms/update_field' AJAX action in all versions up to, and including, 3.28.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitr

CVE-2024-11722 [MEDIUM] CWE-89 CVE-2024-11722: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderb The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additiona

CVE-2026-10039 [MEDIUM] CWE-89 CVE-2026-10039: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 3.28.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administ

CVE-2024-11720 [MEDIUM] CWE-79 CVE-2024-11720: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting v The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms in all versions up to, and including, 3.24.5 due to insufficient input sanitization and output escaping on the new Taxonomy form. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that wil