Is my WordPress plugin safe?

• Oct 14, 2026Frontend Dashboard: Incorrect Privilege AssignmentCVE-2026-107424 · affects up to 3.0.7 · reported by PatchstackCritical 9.8

  Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.

  NVD recordpatchstack.com

• Oct 8, 2026Frontend Dashboard: Does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request dataCVE-2026-103692 · fixed in 3.0.5 · reported by WPScanCritical 9.8

  The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.

  NVD recordwpscan.com

• Oct 7, 2026Frontend Dashboard: Does not perform a capability check in one of its AJAX actionsCVE-2026-103681 · fixed in 3.0.0 · reported by WPScanMedium 4.3

  The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields.

  NVD recordwpscan.com

• Jun 6, 2025Frontend Dashboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49310 · affects up to 2.2.8 · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Stored XSS.This issue affects Frontend Dashboard: from n/a through <= 2.2.8.

  NVD recordpatchstack.com

• May 13, 2025Frontend Dashboard: Privilege EscalationCVE-2025-4474 · affects 1.0 to 2.2.7 · reported by WordfenceHigh 8.8

  The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_admin_setting_form_function() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin’s 'register' role setting to make new user registrations default to the administrator role, leading to an elevation of privileges to that of an administrator.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 13, 2025Frontend Dashboard: Privilege EscalationCVE-2025-4473 · affects 1.0 to 2.2.7 · reported by WordfenceHigh 8.8

  The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_request() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to control where the plugin sends outgoing emails. By pointing SMTP to their own server, attackers could capture password reset emails intended for administrators, and elevate their privileges for full site takeover.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 7, 2025Frontend Dashboard: Privilege EscalationCVE-2025-4104 · affects 1.0 to 2.2.6 · reported by WordfenceCritical 9.8

  The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_wp_ajax_fed_login_form_post() function in versions 1.0 to 2.2.6. This makes it possible for unauthenticated attackers to reset the administrator’s email and password, and elevate their privileges to that of an administrator.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 24, 2025Frontend Dashboard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-46248 · affects up to 2.2.5 · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows SQL Injection.This issue affects Frontend Dashboard: from n/a through <= 2.2.5.

  NVD recordpatchstack.com

• Sep 9, 2024Frontend Dashboard: Unauthorized code executionCVE-2024-8268 · affects up to 2.2.4 · reported by WordfenceHigh 8.8

  The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the ajax_request() function in all versions up to, and including, 2.2.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to call arbitrary functions that can be leverage for privilege escalation by changing user's passwords.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 24, 2024Frontend Dashboard: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32726 · affects up to 2.2.2 · reported by PatchstackHigh 7.5

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in vinoth06. Frontend Dashboard.This issue affects Frontend Dashboard: from n/a through 2.2.2.

  NVD recordpatchstack.compatchstack.com

• Mar 27, 2024Frontend Dashboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29775 · affects up to 2.2.1 · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vinoth06. Frontend Dashboard allows Stored XSS.This issue affects Frontend Dashboard: from n/a through 2.2.1.

  NVD recordpatchstack.compatchstack.com

Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.