CVE-2026-81346 Frontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...

PT-2026-83417

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.11 Description The plugin fails to perform a capability check on an AJAX action. This allows any authenticated user, including those with subscriber-level privileges, to delete arbitrary...

CVE-2026-81346: Missing Authorization

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...

CVE-2026-66638

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66638 WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66638 WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66638

The Frontend Admin by DynamiApps WordPress plugin (versions ≤ 3.29.10) contains a contributor-level reflected/stored Cross-Site Scripting (XSS) flaw. A user with contributor privileges can inject malicious scripts that execute in other users' browsers. CVSS 3.1 scores this MEDIUM (6.5) with netwo...

CVE-2026-66638

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

EUVD-2026-60923

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.10...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter vulnerability

Unauthenticated Privilege Escalation via 'itemid' Parameter vulnerability discovered by 밥김국 - DDADDA in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.9...

CVE-2026-66638: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

PT-2026-77066

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

WordPress Frontend Admin by DynamiApps plugin < 3.29.9 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Frontend Admin by DynamiApps versions 3.29.9...

CVE-2026-18432

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

EUVD-2026-59849

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-18432

CVE-2026-18432 affects the Frontend Admin by DynamiApps plugin for WordPress (≤ 3.29.9). The flaw stems from ActionUser::conditions_logic() gating the current_user_can('edit_user', $user_id) check behind is_numeric(), so a non-numeric string (e.g., 1one) can bypass authorization when supplied via...

CVE-2026-18432

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...