EUVD-2026-96213

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

CVE-2026-6243

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.28.36 . The root cause is the get_dynamic_values function, which performs text-level find-and-replace operations on post content without utilizing HTML-aw...

CVE-2026-6243 Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

CVE-2026-96574

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.3.12 . The root cause is insufficient input sanitizatio...

EUVD-2026-96225

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpufpaymentmethod' parameter in all versions up to, and including, 4.3.12 due to...

CVE-2026-96574 User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpufpaymentmethod' parameter in all versions up to, and including, 4.3.12 due to...

strelka-ui

Releasesrelease | Pull Requestspr | Issuesissues !GitHub releaseimg-version-badgerepo !Build Statusimg-actions-badgeactions-ci !Pull Requestsimg-pr-badgepr !Slackimg-slack-badgeslack !Licenseimg-license-badgelicense La Strelka Web UI è un frontend per l'invio di file basato su browser e API per l...

CVE-2026-96574: Improper Neutralization of Input During Web Page Generation

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpufpaymentmethod' parameter in all versions up to, and including, 4.3.12 due to...

CVE-2026-6243: Improper Neutralization of Input During Web Page Generation

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

PT-2026-109783

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.14 Description An SQL Injection issue exists in the administrator section, allowing an attacker to interfere with the queries that an application makes to its database. Recommendations Update...

CVE-2026-42722: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...

Malicious code in @myorder-frontend-commons/analytics (npm)

Source: ossf-package-analysis 43a2fe0052005fedc0434fc354ae8777e198113f2371fddfbc9d79ffdd87fbb5 The OpenSSF Package Analysis project identified '@myorder-frontend-commons/analytics' @ 99.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated...

WordPress User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin WP User Frontend versions = 4.3.12...

Malicious Package

Overview @myorder-frontend-commons/analytics is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious code in @myorder-frontend-commons/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e5f7ea46a15cf0b816818dfef340f91e8e4b3b8ac149af84cf133282a90202e Package is published to the public npm scope @myorder-frontend-commons and declares preinstall, install, and postinstall lifecycle scripts all set to...

MAL-2026-17749 Malicious code in @myorder-frontend-commons/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e5f7ea46a15cf0b816818dfef340f91e8e4b3b8ac149af84cf133282a90202e Package is published to the public npm scope @myorder-frontend-commons and declares preinstall, install, and postinstall lifecycle scripts all set to...

WordPress Frontend Admin by DynamiApps plugin <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Frontend Admin by DynamiApps versions = 3.28.36...

GHSA-343H-94H5-C4WR vulnerabilities

Vulnerabilities for packages: cassandra-fips, flink-kubernetes-operator, automq-fips, confluent-kafka-jre-bcfips, kafka-fips, apicurio-registry-fips, kafka, akhq, apache-hop, spark-fips, apache-pulsar, sonarqube, elasticsearch-fips, traccar-fips, flink-kubernetes-operator-fips, wazuh-indexer,...

GHSA-GM45-99XC-R7WV vulnerabilities

Vulnerabilities for packages: cassandra-fips, flink-kubernetes-operator, automq-fips, confluent-kafka-jre-bcfips, kafka-fips, apicurio-registry-fips, kafka, akhq, apache-hop, spark-fips, apache-pulsar, sonarqube, elasticsearch-fips, traccar-fips, flink-kubernetes-operator-fips, wazuh-indexer,...

CVE-2026-106450 vulnerabilities

Vulnerabilities for packages: cassandra-fips, flink-kubernetes-operator, automq-fips, confluent-kafka-jre-bcfips, kafka-fips, apicurio-registry-fips, kafka, akhq, apache-hop, spark-fips, apache-pulsar, sonarqube, elasticsearch-fips, traccar-fips, flink-kubernetes-operator-fips, wazuh-indexer,...