CVE-2026-96574: Improper Neutralization of Input During Web Page Generation

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpufpaymentmethod' parameter in all versions up to, and including, 4.3.12 due to...

CVE-2026-6243: Improper Neutralization of Input During Web Page Generation

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

CVE-2026-42722: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...

PT-2026-109783

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.14 Description An SQL Injection issue exists in the administrator section, allowing an attacker to interfere with the queries that an application makes to its database. Recommendations Update...

Malicious code in @myorder-frontend-commons/analytics (npm)

Source: ossf-package-analysis 43a2fe0052005fedc0434fc354ae8777e198113f2371fddfbc9d79ffdd87fbb5 The OpenSSF Package Analysis project identified '@myorder-frontend-commons/analytics' @ 99.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated...

WordPress User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin WP User Frontend versions = 4.3.12...

Malicious Package

Overview @myorder-frontend-commons/analytics is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

MAL-2026-17749 Malicious code in @myorder-frontend-commons/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e5f7ea46a15cf0b816818dfef340f91e8e4b3b8ac149af84cf133282a90202e Package is published to the public npm scope @myorder-frontend-commons and declares preinstall, install, and postinstall lifecycle scripts all set to...

Malicious code in @myorder-frontend-commons/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e5f7ea46a15cf0b816818dfef340f91e8e4b3b8ac149af84cf133282a90202e Package is published to the public npm scope @myorder-frontend-commons and declares preinstall, install, and postinstall lifecycle scripts all set to...

WordPress Frontend Admin by DynamiApps plugin <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Frontend Admin by DynamiApps versions = 3.28.36...

CVE-2026-106450 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, apache-nifi, logstash, elasticsearch, kayenta, flink-kubernetes-operator-fips, wazuh-indexer, apache-polaris-fips, apache-pulsar-fips, flink-kubernetes-operator, apache-polaris, kafbat-ui, confluent-kafka-jre-bcfips, opensearch-fips, kafka-fip...

GHSA-343H-94H5-C4WR vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, apache-nifi, logstash, elasticsearch, kayenta, flink-kubernetes-operator-fips, wazuh-indexer, apache-polaris-fips, apache-pulsar-fips, flink-kubernetes-operator, apache-polaris, kafbat-ui, confluent-kafka-jre-bcfips, opensearch-fips, kafka-fip...

GHSA-GM45-99XC-R7WV vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, apache-nifi, logstash, elasticsearch, kayenta, flink-kubernetes-operator-fips, wazuh-indexer, apache-polaris-fips, apache-pulsar-fips, flink-kubernetes-operator, apache-polaris, kafbat-ui, confluent-kafka-jre-bcfips, opensearch-fips, kafka-fip...

WordPress Frontend Dashboard plugin 3.0.0-3.0.4 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Ryan Fabella in WordPress Plugin Frontend Dashboard versions 3.0.0-3.0.4...

CVE-2026-103692

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including...

CVE-2026-103692 Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including...

EUVD-2026-94762

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including...

CVE-2026-103692

The Frontend Dashboard WordPress plugin (versions 3.0.0-3.0.4 ) is vulnerable to unauthenticated privilege escalation . The root cause is a lack of authorisation or nonce checks on actions available to unauthenticated users, which allow an attacker to trigger an attacker-chosen PHP function or cl...

CVE-2026-103692: Improper Privilege Management

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including...

PT-2026-107829

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including...