CVE-2025-13342

CVE-2025-13342 PoC WordPress के लिए DynamiApps का Frontend Admin प्लगइन, संस्करण 3.28.20 तक और सहित सभी संस्करणों में, वर्डप्रेस विकल्पों के अनधिकृत संशोधन के प्रति संवेदनशील है। इससे हमलावर उपयोगकर्ताओं को पंजीकृत कर सकते हैं और डिफ़ॉल्ट भूमिका को व्यवस्थापक पर सेट कर सकते हैं। यदि Frontend Admi...

DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update

DynamiApps Frontend Admin plugin for WordPress .= 3.28.20 contains a broken access control vulnerability caused by insufficient capability checks and input validation in ActionOptions::run save handler, letting unauthenticated attackers modify critical WordPress options via crafted form data. id:...

CVE-2026-81347

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...

CVE-2026-81347 Frontend Admin by DynamiApps < 3.29.13 - Unauthenticated .htaccess and index.php Deletion via Custom Directory Path Traversal

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...

CVE-2026-81347

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 fails to properly validate a user-controllable directory path before deleting files within it. This allows unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress roo...

EUVD-2026-70908

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...

CVE-2025-13342

CVE-2025-13342 Frontend Admin by DynamiApps - ----/| |/ ----| \ ||/ / / / //// |// |/...

CVE-2025-14736

CVE-2025-14736 Frontend Admin by DynamiApps - अप्रमाणित विशेषाधिकार वृद्धि लेखक: Hyun Chiya भेद्यता जानकारी क्षेत्र| मान ---|--- CVE आईडी| CVE-2025-14736 प्लगइन| Frontend Admin by DynamiApps प्रभावित संस्करण| B"Extract Nonce acfnonce & Form ID acfform" B -- C"Construct POST payload with...

CVE-2026-19952

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the movefolders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

CVE-2026-12747

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-68978

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-12747

The Frontend Admin by DynamiApps plugin for WordPress (versions ≤ 3.29.11) is affected by an authenticated Stored Cross-Site Scripting vulnerability via the 'tag' Shortcode Attribute , caused by insufficient input sanitization and output escaping. Attackers with contributor-level access or higher...

CVE-2026-12747 Frontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-19952 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the movefolders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

EUVD-2026-68973

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the movefolders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

CVE-2026-19952

The Frontend Admin by DynamiApps WordPress plugin (versions ≤ 3.29.12 ) is vulnerable to unauthenticated arbitrary file deletion caused by insufficient file path validation in the move_folders function, specifically via the custom_directory_name Merge Tag. Discovered by nudien , the flaw allows a...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag vulnerability

Unauthenticated Arbitrary File Deletion via Path Traversal via customdirectoryname Merge Tag vulnerability discovered by nudien in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.12...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'tag' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.11...

CVE-2026-81346

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...

EUVD-2026-68065

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...