What’s Vulnerable › Products

shabti Frontend Admin by DynamiApps vulnerabilities

29 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 26 published in the last 12 months.

Check whether your shabti Frontend Admin by DynamiApps version is affected

Latest shabti Frontend Admin by DynamiApps vulnerabilities

• CVE-2026-109892 — WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability (CVSS 9.8)
• CVE-2026-42722 — WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability (CVSS 7.6)
• CVE-2026-6243 — Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content (CVSS 6.4)
• CVE-2026-75816 — Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier (CVSS 9.8)
• CVE-2026-19952 — Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag (CVSS 7.5)
• CVE-2026-12747 — Frontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute (CVSS 6.4)
• CVE-2026-66638 — WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2026-18432 — Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter (CVSS 9.8)
• CVE-2026-15606 — Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token (CVSS 8.8)
• CVE-2026-66662 — WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability (CVSS 9.8)
• CVE-2026-66470 — WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerability (CVSS 7.1)
• CVE-2026-10039 — Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter (CVSS 4.9)
• CVE-2026-6226 — Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection (CVSS 8.8)
• CVE-2026-7802 — Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter (CVSS 8.8)
• CVE-2026-6228 — Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form (CVSS 8.8)
• CVE-2026-3328 — Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts (CVSS 7.2)
• CVE-2025-14937 — Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field' (CVSS 7.2)
• CVE-2025-14741 — Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element (CVSS 9.1)
• CVE-2025-14736 — Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field (CVSS 9.8)
• CVE-2025-13342 — Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update (CVSS 9.8)
• CVE-2025-49267 — WordPress Frontend Admin by DynamiApps plugin <= 3.28.3 - SQL Injection vulnerability (CVSS 8.5)
• CVE-2025-49303 — WordPress Frontend Admin by DynamiApps plugin <= 3.28.7 - Arbitrary File Download Vulnerability (CVSS 6.8)
• CVE-2025-26987 — WordPress Frontend Admin by DynamiApps plugin <= 3.25.17 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
• CVE-2024-11722 — Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injection (CVSS 5.9)
• CVE-2024-11721 — Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalation (CVSS 8.1)