Frontend Admin by DynamiApps

Güvenlik açıkları

• CVE-2026-75816kimlik doğrulamasız≤ 3.29.12

  Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

  Kritik 9.8

• CVE-2026-18432kimlik doğrulamasız≤ 3.29.9

  Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

  Kritik 9.8

• CVE-2026-66662kimlik doğrulamasız≤ 3.29.10

  WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability

  Kritik 9.8

• CVE-2025-14736kimlik doğrulamasız≤ 3.28.29

  Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field

  Kritik 9.8

• CVE-2025-13342kimlik doğrulamasız≤ 3.28.20

  Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update

  Kritik 9.8

• CVE-2024-3729kimlik doğrulamasız≤ 3.19.4

  Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation

  Kritik 9.8

• CVE-2023-51411kimlik doğrulamasız≤ 3.18.3

  WordPress Frontend Admin by DynamiApps Plugin <= 3.18.3 is vulnerable to Arbitrary File Upload

  Kritik 9.8

• CVE-2025-14741kimlik doğrulamasız≤ 3.28.25

  Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element

  Kritik 9.1

• CVE-2026-6226kimlik doğrulamasız≤ 3.29.2

  Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection

  Yüksek 8.8

• CVE-2026-6228kimlik doğrulamasız≤ 3.28.36

  Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form

  Yüksek 8.8

• CVE-2026-15606abone+≤ 3.29.9

  Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token

  Yüksek 8.8

• CVE-2026-7802abone+≤ 3.29.2

  Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter

  Yüksek 8.8

• CVE-2025-49267giriş gerekir≤ 3.28.3

  WordPress Frontend Admin by DynamiApps plugin <= 3.28.3 - SQL Injection vulnerability

  Yüksek 8.5

• CVE-2024-11721kimlik doğrulamasız≤ 3.24.5

  Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalation

  Yüksek 8.1

• CVE-2026-19952kimlik doğrulamasız≤ 3.29.12

  Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag

  Yüksek 7.5

• CVE-2025-14937kimlik doğrulamasız≤ 3.28.23

  Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field'

  Yüksek 7.2

• CVE-2026-3328editör+≤ 3.28.31

  Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts

  Yüksek 7.2

• CVE-2026-66470abone+≤ 3.29.10

  WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerability

  Yüksek 7.1

• CVE-2025-49303yüksek yetki≤ 3.28.7

  WordPress Frontend Admin by DynamiApps plugin <= 3.28.7 - Arbitrary File Download Vulnerability

  Orta 6.8

• CVE-2026-66638katılımcı+≤ 3.29.10

  WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability

  Orta 6.5

• CVE-2026-12747katılımcı+≤ 3.29.11

  Frontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute

  Orta 6.4

• CVE-2025-26987kimlik doğrulamasız · tıklama gerekir≤ 3.25.17

  WordPress Frontend Admin by DynamiApps plugin <= 3.25.17 - Reflected Cross Site Scripting (XSS) vulnerability

  Orta 6.1

• CVE-2024-11720kimlik doğrulamasız≤ 3.24.5

  Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site Scripting

  Orta 6.1

• CVE-2024-11722kimlik doğrulamasız≤ 3.25.1

  Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injection

  Orta 5.9

• CVE-2026-10039yönetici≤ 3.28.8

  Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter

  Orta 4.9