Frontend Admin by DynamiApps

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Frontend Admin by DynamiApps

Information

Software Type Plugin
Software Slug acf-frontend-form-element (view on wordpress.org)
Software Status Active
Software Author shabti
Software Website www.dynamiapps.com
Software Downloads 983,250
Software Active Installs 9,000
Software Record Last Updated September 7, 2026

Showing 1-20 of 30 Vulnerabilities

Submit a Vulnerability
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier
9.8
CVE-2026-75816
Sep 5, 2026
Researcher: thevietronin
Frontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute
6.4
CVE-2026-12747
Aug 31, 2026
Researcher: Wordfence PRISM
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag
7.5
CVE-2026-19952
Aug 31, 2026
Researcher: nudien
Frontend Admin by DynamiApps < 3.29.11 - Authenticated (Subscriber+) Membership Plan Deletion
4.3
CVE-2026-81346
Aug 27, 2026
Researcher: Sai Praneeth Koti
Frontend Admin by DynamiApps <= 3.29.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-66638
Aug 18, 2026
Researcher: Ananda Dhakal
Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter
9.8
CVE-2026-18432
Aug 15, 2026
Researcher: 밥김국
Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token
8.8
CVE-2026-15606
Aug 11, 2026
Researcher: daroo
Frontend Admin by DynamiApps <= 3.29.10 - Unauthenticated Privilege Escalation
9.8
CVE-2026-66662
Aug 5, 2026
Researcher: Doan Dinh Van
Frontend Admin by DynamiApps < 3.29.7 - Missing Authorization
4.3
CVE-2026-11867
Aug 5, 2026
Researcher: Meher Sudhakar Abbireddi
Frontend Admin by DynamiApps <= 3.29.10 - Missing Authorization
4.3
CVE-2026-66470
Aug 5, 2026
Researcher: okndjo
Frontend Admin by DynamiApps <= 3.29.8 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-13609
Jul 16, 2026
Researcher: Sai Praneeth Koti
Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
4.9
CVE-2026-10039
May 28, 2026
Researchers: Louis Deschanel (JeanJeanLeHaxor), Pascal SUN
Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter
8.8
CVE-2026-7802
May 27, 2026
Researcher: Tiago Ventura (perses)
Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection
8.8
CVE-2026-6226
May 27, 2026
Researcher: daroo
Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form
8.8
CVE-2026-6228
May 14, 2026
Researcher: Colin Xu
Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts
7.2
CVE-2026-3328
Mar 25, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field'
7.2
CVE-2025-14937
Jan 8, 2026
Researcher: Paolo Tresso
Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element
9.1
CVE-2025-14741
Jan 8, 2026
Researcher: andrea bocchetti
Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field
9.8
CVE-2025-14736
Jan 8, 2026
Researcher: andrea bocchetti
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
9.8
CVE-2025-13342
Dec 3, 2025
Researcher: YC_Infosec
Title Status CVE ID CVSS Researchers Date
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier Patched CVE-2026-75816 9.8 thevietronin September 5, 2026
Frontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute Patched CVE-2026-12747 6.4 Wordfence PRISM August 31, 2026
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag Patched CVE-2026-19952 7.5 nudien August 31, 2026
Frontend Admin by DynamiApps < 3.29.11 - Authenticated (Subscriber+) Membership Plan Deletion Patched CVE-2026-81346 4.3 Sai Praneeth Koti August 27, 2026
Frontend Admin by DynamiApps <= 3.29.10 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-66638 6.4 Ananda Dhakal August 18, 2026
Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter Patched CVE-2026-18432 9.8 밥김국 August 15, 2026
Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token Patched CVE-2026-15606 8.8 daroo August 11, 2026
Frontend Admin by DynamiApps <= 3.29.10 - Unauthenticated Privilege Escalation Unpatched CVE-2026-66662 9.8 Doan Dinh Van August 5, 2026
Frontend Admin by DynamiApps < 3.29.7 - Missing Authorization Patched CVE-2026-11867 4.3 Meher Sudhakar Abbireddi August 5, 2026
Frontend Admin by DynamiApps <= 3.29.10 - Missing Authorization Patched CVE-2026-66470 4.3 okndjo August 5, 2026
Frontend Admin by DynamiApps <= 3.29.8 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-13609 7.2 Sai Praneeth Koti July 16, 2026
Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter Patched CVE-2026-10039 4.9 Louis Deschanel (JeanJeanLeHaxor), Pascal SUN May 28, 2026
Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter Patched CVE-2026-7802 8.8 Tiago Ventura (perses) May 27, 2026
Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection Patched CVE-2026-6226 8.8 daroo May 27, 2026
Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form Patched CVE-2026-6228 8.8 Colin Xu May 14, 2026
Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts Patched CVE-2026-3328 7.2 Osvaldo Noe Gonzalez Del Rio (Os) March 25, 2026
Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field' Patched CVE-2025-14937 7.2 Paolo Tresso January 8, 2026
Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element Patched CVE-2025-14741 9.1 andrea bocchetti January 8, 2026
Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field Patched CVE-2025-14736 9.8 andrea bocchetti January 8, 2026
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update Patched CVE-2025-13342 9.8 YC_Infosec December 3, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation