VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

ACF Frontend Admin by DynamiApps security & vulnerabilities

acf-frontend-form-element— active installsLast vulnerability Nov 7, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
38Known vulnerabilities
  • Critical8
  • High14
  • Medium16
  • Low0
Vulnerabilities per year
2022: 1 vulnerability1222023: 2 vulnerabilities2232024: 4 vulnerabilities4242025: 4 vulnerabilities4252026: 27 vulnerabilities2726

All ACF Frontend Admin by DynamiApps vulnerabilities

ACF Frontend Admin by DynamiApps vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.30.1Update to 3.30.2
CVE-2026-119504
High7.3Unauthenticated Privilege Escalation
≤3.30.1Update to 3.30.2
CVE-2026-119506
Medium5.3Missing Authorization
≤3.29.0Update to 3.30.0
CVE-2026-81343
Medium6.6Authenticated (Administrator+) PHP Object Injection
≤3.29.0Update to 3.30.0
CVE-2026-81344
High7.3Unauthenticated Privilege Escalation
≤3.29.13Update to 3.30.0
CVE-2026-109892
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
≤3.28.36Update to 3.29.1
CVE-2026-6243
Medium4.9Authenticated (Administrator+) SQL Injection
≤3.29.13Update to 3.30.0
CVE-2026-42722
Critical9.8Unauthenticated Account Takeover via '_acf_objects' Object Identifier
≤3.29.12Update to 3.29.13
CVE-2026-75816
High8.2Unauthenticated Path Traversal
≤3.29.12Update to 3.29.13
CVE-2026-81347
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute
≤3.29.11Update to 3.29.12
CVE-2026-12747
High7.5Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag
≤3.29.12Update to 3.29.13
CVE-2026-19952
Medium4.3Authenticated (Subscriber+) Membership Plan Deletion
<3.29.11Update to 3.29.11
CVE-2026-81346
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.29.10Update to 3.29.11
CVE-2026-66638
Critical9.8Unauthenticated Privilege Escalation via 'item_id' Parameter
≤3.29.9Update to 3.29.10
CVE-2026-18432
High8.8Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token
≤3.29.9Update to 3.29.10
CVE-2026-15606
Critical9.8Unauthenticated Privilege Escalation
≤3.29.12Update to 3.29.13
CVE-2026-66662
Medium4.3Missing Authorization
<3.29.7Update to 3.29.7
CVE-2026-11867
Medium4.3Missing Authorization
≤3.29.10Update to 3.29.11
CVE-2026-66470
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.29.8Update to 3.29.9
CVE-2026-13609
Medium4.9Authenticated (Administrator+) SQL Injection via 'order' Parameter
≤3.28.8Update to 3.28.29
CVE-2026-10039
High8.8Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter
≤3.29.2Update to 3.29.3
CVE-2026-7802
High8.8Unauthenticated Privilege Escalation via Form Configuration Injection
≤3.29.2Update to 3.29.3
CVE-2026-6226
High8.8Unauthenticated Privilege Escalation via Edit User Form
≤3.28.36Update to 3.29.1
CVE-2026-6228
High7.2Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts
≤3.28.31Update to 3.28.32
CVE-2026-3328
High7.2Unauthenticated Stored Cross-Site Scripting via 'update_field'
≤3.28.23Update to 3.28.24
CVE-2025-14937
Critical9.1Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element
≤3.28.25Update to 3.28.26
CVE-2025-14741
Critical9.8Unauthenticated Privilege Escalation to Administrator via Role Form Field
≤3.28.29Update to 3.28.30
CVE-2025-14736
Critical9.8Unauthenticated Arbitrary Options Update
≤3.28.20Update to 3.28.21
CVE-2025-13342
Medium6.5Authenticated (Subscriber+) SQL Injection
≤3.28.3Update to 3.28.5
CVE-2025-49267
Medium6.5Authenticated (Editor+) Arbitrary File Deletion
≤3.28.7Update to 3.28.8
CVE-2025-49303
Medium6.1Reflected Cross-Site Scripting
≤3.25.17Update to 3.25.18
CVE-2025-26987
Medium5.9Unauthenticated SQL Injection
≤3.25.1Update to 3.25.2
CVE-2024-11722
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.24.5Update to 3.25.1
CVE-2024-11720
High8.1Unauthenticated Privilege Escalation
≤3.24.5Update to 3.25.1
CVE-2024-11721
Critical9.8Improper Missing Encryption Exception Handling to Form Manipulation
≤3.19.4Update to 3.19.5
CVE-2024-3729
Critical9.8Unauthenticated Arbitrary File Upload
≤3.18.3Update to 3.18.4
CVE-2023-51411
Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
CVE-2023-33999
Medium6.3Missing Authorization Checks
all versionsNo patch available
CVE-2022-4974

ACF Frontend Admin by DynamiApps: common questions

Does ACF Frontend Admin by DynamiApps have known vulnerabilities?

Yes. VulnCrest Radar lists 38 known vulnerabilities in ACF Frontend Admin by DynamiApps: 8 critical, 14 high, 16 medium. At least one is not fixed in the latest version.

How do I check which version of ACF Frontend Admin by DynamiApps I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent ACF Frontend Admin by DynamiApps vulnerability?

CVE-2026-119504, published Nov 7, 2026: ACF Frontend Admin by DynamiApps <= 3.30.1 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).

Is any ACF Frontend Admin by DynamiApps vulnerability listed in CISA KEV?

No. None of the known ACF Frontend Admin by DynamiApps vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?