Acf Frontend Form Element Vulnerabilities

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.29.10. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arb...

CVSS:

6.4

Affected:

up to 3.29.10

Fixed in:

3.29.11

Disclosed:

Aug 18, 2026

CVE-2026-66638 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` authorization check behind an `is_numeric()` test, causing the c...

CVSS:

9.8

Affected:

up to 3.29.9

Fixed in:

3.29.10

Disclosed:

Aug 15, 2026

CVE-2026-18432 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level and above p...

CVSS:

8.8

Affected:

up to 3.29.9

Fixed in:

3.29.10

Disclosed:

Aug 11, 2026

CVE-2026-15606 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.10. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

CVSS:

9.8

Affected:

up to 3.29.10

Fix:

No patched version reported

Disclosed:

Aug 5, 2026

CVE-2026-66662 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.29.10. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 3.29.10

Fixed in:

3.29.11

Disclosed:

Aug 5, 2026

CVE-2026-66470 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to 3.29.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 3.29.7

Fixed in:

3.29.7

Disclosed:

Aug 5, 2026

CVE-2026-11867 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.29.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever...

CVSS:

7.2

Affected:

up to 3.29.8

Fixed in:

3.29.9

Disclosed:

Jul 16, 2026

CVE-2026-13609 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 3.28.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authen...

CVSS:

4.9

Affected:

up to 3.28.8

Fixed in:

3.28.29

Disclosed:

May 28, 2026

CVE-2026-10039 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...

CVSS:

8.8

Affected:

up to 3.29.2

Fixed in:

3.29.3

Disclosed:

May 27, 2026

CVE-2026-7802 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to insecure form submission handling that accepts arbitrary form definitions from user input instead of securely loading them from the backend. When $_POST['_ac...

CVSS:

8.8

Affected:

up to 3.29.2

Fixed in:

3.29.3

Disclosed:

May 27, 2026

CVE-2026-6226 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the admin_form post type. The admin_form custom post t...

CVSS:

8.8

Affected:

up to 3.28.36

Fixed in:

3.29.1

Disclosed:

May 14, 2026

CVE-2026-6228 on NVD →

Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts vulnerability

CVSS:

7.2

Affected:

up to 3.28.31

Fixed in:

3.28.32

Disclosed:

Mar 30, 2026

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's `maybe_unserialize()` function without class restrictions on user-controllable co...

CVSS:

7.2

Affected:

up to 3.28.31

Fixed in:

3.28.32

Disclosed:

Mar 25, 2026

CVE-2026-3328 on NVD →

[en] The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acff' parameter in the 'frontend_admin/forms/update_field' AJAX action in all versions up to, and including, 3.28.23 due to insufficient input sanitization and output escaping. This makes it possible for una...

Affected:

up to 3.28.24

Fixed in:

3.28.24

Disclosed:

Jan 9, 2026

CVE-2025-14937 on NVD →

[en] The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.25. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for...

Affected:

up to 3.28.26

Fixed in:

3.28.26

Disclosed:

Jan 9, 2026

CVE-2025-14736 on NVD →

[en] The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for unauthenticated attackers to delete...

Affected:

up to 3.28.26

Fixed in:

3.28.26

Disclosed:

Jan 9, 2026

CVE-2025-14741 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acff' parameter in the 'frontend_admin/forms/update_field' AJAX action in all versions up to, and including, 3.28.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthen...

CVSS:

7.2

Affected:

up to 3.28.23

Fixed in:

3.28.24

Disclosed:

Jan 8, 2026

CVE-2025-14937 on NVD →

Affected:

up to 3.28.24

Fixed in:

3.28.24

Disclosed:

Jan 8, 2026

CVE-2025-14937 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for unauthenticated attackers to delete arbi...

CVSS:

9.1

Affected:

up to 3.28.25

Fixed in:

3.28.26

Disclosed:

Jan 8, 2026

CVE-2025-14741 on NVD →

Affected:

up to 3.28.26

Fixed in:

3.28.26

Disclosed:

Jan 8, 2026

CVE-2025-14741 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for unaut...

CVSS:

9.8

Affected:

up to 3.28.29

Fixed in:

3.28.30

Disclosed:

Jan 8, 2026

CVE-2025-14736 on NVD →

Affected:

up to 3.28.26

Fixed in:

3.28.26

Disclosed:

Jan 8, 2026

CVE-2025-14736 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handler. This makes it possible for unauthent...

CVSS:

9.8

Affected:

up to 3.28.20

Fixed in:

3.28.21

Disclosed:

Dec 3, 2025

CVE-2025-13342 on NVD →

Affected:

up to 3.28.21

Fixed in:

3.28.21

Disclosed:

Dec 3, 2025

CVE-2025-13342 on NVD →

[en] The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handler. This makes it possible for unau...

Affected:

up to 3.28.21

Fixed in:

3.28.21

Disclosed:

Dec 3, 2025

CVE-2025-13342 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps allows Blind SQL Injection. This issue affects Frontend Admin by DynamiApps: from n/a through 3.28.3.

Affected:

up to 3.28.5

Fixed in:

3.28.5

Disclosed:

Aug 14, 2025

CVE-2025-49267 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.28.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-lev...

CVSS:

6.5

Affected:

up to 3.28.3

Fixed in:

3.28.5

Disclosed:

Aug 12, 2025

CVE-2025-49267 on NVD →

Affected:

up to 3.28.5

Fixed in:

3.28.5

Disclosed:

Aug 12, 2025

CVE-2025-49267 on NVD →

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps allows Path Traversal. This issue affects Frontend Admin by DynamiApps: from n/a through 3.28.7.

Affected:

up to 3.28.8

Fixed in:

3.28.8

Disclosed:

Jul 4, 2025

CVE-2025-49303 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 3.28.7. This makes it possible for authenticated attackers, with Editor-level access and above, to delete arbitrary files on the server, which can...

CVSS:

6.5

Affected:

up to 3.28.7

Fixed in:

3.28.8

Disclosed:

Jun 26, 2025

CVE-2025-49303 on NVD →

Affected:

up to 3.28.8

Fixed in:

3.28.8

Disclosed:

Jun 26, 2025

CVE-2025-49303 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps allows Reflected XSS. This issue affects Frontend Admin by DynamiApps: from n/a through 3.25.17.

Affected:

up to 3.25.18

Fixed in:

3.25.18

Disclosed:

Feb 25, 2025

CVE-2025-26987 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.25.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they c...

CVSS:

6.1

Affected:

up to 3.25.17

Fixed in:

3.25.18

Disclosed:

Feb 23, 2025

CVE-2025-26987 on NVD →

Affected:

up to 3.25.18

Fixed in:

3.25.18

Disclosed:

Feb 23, 2025

CVE-2025-26987 on NVD →

[en] The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthe...

Affected:

up to 3.25.2

Fixed in:

3.25.2

Disclosed:

Dec 21, 2024

CVE-2024-11722 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthentica...

CVSS:

5.9

Affected:

up to 3.25.1

Fixed in:

3.25.2

Disclosed:

Dec 20, 2024

CVE-2024-11722 on NVD →

Affected:

up to 3.25.2

Fixed in:

3.25.2

Disclosed:

Dec 20, 2024

CVE-2024-11722 on NVD →

[en] The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms in all versions up to, and including, 3.24.5 due to insufficient input sanitization and output escaping on the new Taxonomy form. This makes it possible for unauthenticated attackers to inject ar...

Affected:

up to 3.25.1

Fixed in:

3.25.1

Disclosed:

Dec 14, 2024

CVE-2024-11720 on NVD →

[en] The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the 'Role' field in a form. This makes it possible for unauthenticated attackers to create new...

Affected:

up to 3.25.1

Fixed in:

3.25.1

Disclosed:

Dec 14, 2024

CVE-2024-11721 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the 'Role' field in a form. This makes it possible for unauthenticated attackers to create new admin...

CVSS:

8.1

Affected:

up to 3.24.5

Fixed in:

3.25.1

Disclosed:

Dec 13, 2024

CVE-2024-11721 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms in all versions up to, and including, 3.24.5 due to insufficient input sanitization and output escaping on the new Taxonomy form. This makes it possible for unauthenticated attackers to inject arbitra...

CVSS:

7.2

Affected:

up to 3.24.5

Fixed in:

3.25.1

Disclosed:

Dec 13, 2024

CVE-2024-11720 on NVD →

Affected:

up to 3.25.1

Fixed in:

3.25.1

Disclosed:

Dec 13, 2024

CVE-2024-11721 on NVD →

Affected:

up to 3.25.1

Fixed in:

3.25.1

Disclosed:

Dec 13, 2024

CVE-2024-11720 on NVD →

[en] The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4....

Affected:

up to 3.3.33

Fixed in:

3.3.33

Disclosed:

Oct 16, 2024

CVE-2022-4974 on NVD →

[en] The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can be used to add a...

Affected:

up to 3.19.5

Fixed in:

3.19.5

Disclosed:

May 2, 2024

CVE-2024-3729 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can be used to add and ed...

CVSS:

9.8

Affected:

up to 3.19.4

Fixed in:

3.19.5

Disclosed:

Apr 18, 2024

CVE-2024-3729 on NVD →

Affected:

up to 3.19.5

Fixed in:

3.19.5

Disclosed:

Apr 18, 2024

CVE-2024-3729 on NVD →

[en] Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps.This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.

Affected:

up to 3.18.4

Fixed in:

3.18.4

Disclosed:

Dec 29, 2023

CVE-2023-51411 on NVD →

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_add_attachment' function in all versions up to, and including, 3.18.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's serv...

CVSS:

9.8

Affected:

up to 3.18.3

Fixed in:

3.18.4

Disclosed:

Dec 27, 2023

CVE-2023-51411 on NVD →

Affected:

up to 3.18.4

Fixed in:

3.18.4

Disclosed:

Dec 27, 2023

CVE-2023-51411 on NVD →

The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...

CVSS:

6.1

Affected:

up to 3.7.11

Fixed in:

3.8.0

Disclosed:

Jul 18, 2023

CVE-2023-33999 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

CVSS:

6.3

Affected:

up to 3.3.33

Fixed in:

3.3.33

Disclosed:

Mar 4, 2022

CVE-2022-4974 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

Affected:

up to 3.3.33

Fixed in:

3.3.33

Disclosed:

Mar 4, 2022

Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress "ACF Frontend – Add and edit posts, pages, users and more all from the frontend" plugin (versions < 3.3.33).

Affected:

up to 3.3.33

Fixed in:

3.3.33

Disclosed:

Feb 28, 2022

Sensitive Information Disclosure vulnerability discovered in WordPress "ACF Frontend – Add and edit posts, pages, users and more all from the frontend" plugin (versions < 3.3.33).

Affected:

up to 3.3.33

Fixed in:

3.3.33

Disclosed:

Feb 28, 2022

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 3.8.0

Fixed in:

3.8.0

CVE-2023-33999 on NVD →