Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · acf-frontend-form-element
Frontend Admin by DynamiApps
34 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 17, 2026ACF Frontend Admin by DynamiApps: Does not restrictCVE-2026-81344 · affects up to 3.29.13 · reported by WPScanMedium 6.6
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution.
Oct 17, 2026ACF Frontend Admin by DynamiApps: Does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options storeCVE-2026-81343 · affects up to 3.29.13 · reported by WPScanMedium 5.3
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a public form.
Oct 15, 2026Frontend Admin by DynamiApps: Incorrect Privilege AssignmentCVE-2026-109892 · affects up to 3.29.13 · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13.
Oct 10, 2026Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.CVE-2026-42722 · affects up to 3.29.13 · reported by PatchstackHigh 7.6
Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.
Oct 10, 2026Frontend Admin by DynamiApps: Stored Cross-Site ScriptingCVE-2026-6243 · affects up to 3.28.36 · reported by WordfenceMedium 6.4
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'get_dynamic_values' function performing text-level find-and-replace operations on post content without HTML-aware parsing. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Sep 5, 2026Frontend Admin by DynamiApps: Authentication Bypass to Account TakeoverCVE-2026-75816 · affects up to 3.29.12 · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2026Frontend Admin by DynamiApps: Does not properly validate a user-controllable directory path before deleting files within itCVE-2026-81347 · fixed in 3.29.13 · reported by WPScanMedium 5.9
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.
Sep 1, 2026Frontend Admin by DynamiApps: Arbitrary file deletionCVE-2026-19952 · affects up to 3.29.12 · reported by WordfenceHigh 7.5
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 1, 2026Frontend Admin by DynamiApps: Stored Cross-Site ScriptingCVE-2026-12747 · affects up to 3.29.11 · reported by WordfenceMedium 6.4
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2026Frontend Admin by DynamiApps: Does not perform a capability check on one of its AJAX actionsCVE-2026-81346 · fixed in 3.29.11 · reported by WPScanMedium 4.3
The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans.
Aug 18, 2026Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-66638 · affects up to 3.29.10 · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.
Aug 16, 2026Frontend Admin by DynamiApps: Privilege EscalationCVE-2026-18432 · affects up to 3.29.9 · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` authorization check behind an `is_numeric()` test, causing the check to be skipped entirely when `$user_id` is a non-numeric string — a condition that can be induced by passing a crafted value such as `1one` through the unvalidated `item_id` parameter of the unauthenticated `wp_ajax_nopriv_frontend_admin/forms/change_form` AJAX endpoint. This makes it possible for attackers to escalate privileges to administrator by obtaining a server-signed `_acf_objects` payload carrying the non-numeric user ID, which WordPress subsequently coerces to integer 1 (the default administrator), allowing the attacker to overwrite that account's password or email address. Exploitation by unauthenticated users requires a public-facing frontend user form to be configured; in all other cases a subscriber-level account is sufficient.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 11, 2026Frontend Admin by DynamiApps: Authorization bypassCVE-2026-15606 · affects up to 3.29.9 · reported by WordfenceHigh 8.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to reset the password of any user on the site, including administrators, leading to full account takeover and complete site compromise. Exploitation requires the attacker to hold a valid encrypted Current-User token obtained by accessing any Edit User form they are legitimately authorized to submit, which they then use as a known-plaintext base for the CBC bit-flipping forgery.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 6, 2026Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-66662 · affects up to 3.29.10 · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.
Aug 6, 2026Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-66470 · affects up to 3.29.10 · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.
Jul 31, 2026Frontend Admin by DynamiApps: Decodes HTML entities in a submitted form field value after sanitizing itCVE-2026-13609 · fixed in 3.29.9 · reported by WPScanHigh 8.8
The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output without escaping on the Frontend Admin by DynamiApps WordPress plugin before 3.29.9's front-end display surfaces, resulting in stored cross-site scripting that executes in the browser of any user, including an administrator, who views a page displaying the submitted value.
Jul 30, 2026Frontend Admin by DynamiApps: Does not perform capability checks on its taxonomy term creationCVE-2026-11867 · fixed in 3.29.7 · reported by WPScanMedium 6.5
The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges (such as Subscribers) to create, rename, and delete arbitrary taxonomy terms.
May 29, 2026Frontend Admin by DynamiApps: Generic SQL InjectionCVE-2026-10039 · affects up to 3.28.28 · reported by WordfenceMedium 4.9
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 3.28.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires that the attacker also supply a valid 'orderby' parameter in the same request, as this is necessary to reach the vulnerable code path that processes and concatenates the 'order' value into the SQL query.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 28, 2026Frontend Admin by DynamiApps: Unauthenticated privilege escalationCVE-2026-6226 · affects up to 3.29.2 · reported by WordfenceHigh 8.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to insecure form submission handling that accepts arbitrary form definitions from user input instead of securely loading them from the backend. When $_POST['_acf_form'] is an array (rather than a form ID), the validate_form() function bypasses database lookup and directly processes the attacker-controlled structure. The create_record() function preserves attacker-supplied record data if present, and the user action's run() function falls back to attacker-controlled field definitions from $form['fields'] when legitimate fields cannot be found. The role field's pre_update_value() validation reads $field['role_options'] from this attacker-controlled definition, allowing an attacker to specify ['administrator'] as an allowed role and bypass the security check. This makes it possible for unauthenticated attackers to create administrator accounts by injecting a custom form configuration with a spoofed role field.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 28, 2026Frontend Admin by DynamiApps: Authorization bypassCVE-2026-7802 · affects up to 3.29.2 · reported by WordfenceHigh 8.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite an administrator's user_pass, user_email, first_name, last_name, and other profile fields by supplying an arbitrary ?user_id= value, enabling full administrator account takeover via direct password replacement or email-redirect password reset. Exploitation requires the targeted Edit-User form to have its 'Roles' configuration setting left empty; when a non-empty roles list is configured, load_data() sets the user ID to 'none' for users whose roles fall outside the allowed list, preventing administrators from being targeted through that form.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 15, 2026Frontend Admin by DynamiApps: Privilege EscalationCVE-2026-6228 · affects up to 3.28.36 · reported by WordfenceHigh 8.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the admin_form post type. The admin_form custom post type uses 'capability_type' => 'page', which grants editors the ability to create and edit forms. When an editor creates an edit_user form, they can manipulate the form configuration to include 'administrator' in the role_options array by directly submitting POST data to wp-admin/post.php, bypassing the UI restrictions in feadmin_get_user_roles(). When the form is subsequently submitted, the pre_update_value() function in class-role.php only validates that the submitted role exists in the form's role_options array (lines 107-110), but fails to verify that the current user has permission to assign that specific role. This makes it possible for unauthenticated attackers to first register as editors (via a public new_user form), then create an edit_user form with administrator in the allowed roles, and finally use that form to escalate their own privileges to administrato
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 26, 2026Frontend Admin by DynamiApps: PHP Object InjectionCVE-2026-3328 · affects up to 3.28.31 · reported by WordfenceHigh 7.2
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's `maybe_unserialize()` function without class restrictions on user-controllable content stored in admin_form post content. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 9, 2026Frontend Admin by DynamiApps: Stored Cross-Site ScriptingCVE-2025-14937 · affects up to 3.28.23 · reported by WordfenceHigh 7.2
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acff' parameter in the 'frontend_admin/forms/update_field' AJAX action in all versions up to, and including, 3.28.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Jan 9, 2026Frontend Admin by DynamiApps: Missing authorization to unauthorized data modification and deletionCVE-2025-14741 · affects up to 3.28.25 · reported by WordfenceCritical 9.1
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.
Jan 9, 2026Frontend Admin by DynamiApps: Privilege EscalationCVE-2025-14736 · affects up to 3.28.29 · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for unauthenticated attackers to register as administrators and gain complete control of the site, granted they can access a user registration form containing a Role field.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 3, 2025Frontend Admin by DynamiApps: Unauthorized modification of arbitrary WordPress optionsCVE-2025-13342 · affects up to 3.28.20 · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handler. This makes it possible for unauthenticated attackers to modify critical WordPress options such as users_can_register, default_role, and admin_email via submitting crafted form data to public frontend forms.
Aug 14, 2025Frontend Admin by DynamiApps: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49267 · affects up to 3.28.3 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Blind SQL Injection.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.28.3.
Jul 4, 2025Frontend Admin by DynamiApps: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-49303 · affects up to 3.28.7 · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Path Traversal.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.28.7.
Feb 25, 2025Frontend Admin by DynamiApps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26987 · affects up to 3.25.17 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Reflected XSS.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.25.17.
Dec 21, 2024Frontend Admin by DynamiApps: SQL InjectionCVE-2024-11722 · affects up to 3.25.1 · reported by WordfenceMedium 5.9
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires an unauthenticated user to have been given permission to view form submissions, and the form submission shortcode be added to a page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 14, 2024Frontend Admin by DynamiApps: Privilege escalationCVE-2024-11721 · affects up to 3.24.5 · reported by WordfenceHigh 8.1
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the 'Role' field in a form. This makes it possible for unauthenticated attackers to create new administrative user accounts, even when the administrative user role has not been provided as an option to the user, granted that unauthenticated users have been provided access to the form.
Dec 14, 2024Frontend Admin by DynamiApps: Stored Cross-Site ScriptingCVE-2024-11720 · affects up to 3.24.5 · reported by WordfenceHigh 7.2
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms in all versions up to, and including, 3.24.5 due to insufficient input sanitization and output escaping on the new Taxonomy form. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when lower-level users have been granted access to submit specific forms, which is disabled by default.
May 2, 2024Frontend Admin by DynamiApps: Improper missing encryption exception handling on the 'fea_encrypt' functionCVE-2024-3729 · affects up to 3.19.4 · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can be used to add and edit administrator user for privilege escalation, or to automatically log in users for authentication bypass, or manipulate the post processing form that can be used to inject arbitrary web scripts. This can only be exploited if the 'openssl' php extension is not loaded on the server.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 29, 2023Frontend Admin by DynamiApps: Unrestricted Upload of File with Dangerous TypeCVE-2023-51411 · affects up to 3.18.3 · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps.This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.