WordPress security by component
Frontend Dashboard
Plugin description
Frontend Dashboard provides front-end dashboard interfaces for users to manage WordPress content and account information.
Frontend Dashboard (frontend-dashboard) is a WordPress plugin with 10 published CVE records in this archive. The latest tracked vulnerability was published Oct 08, 2026; the highest published CVSS base score is 9.8.
Plugin slug:
frontend-dashboardLatest vulnerability
CVE-2026-103692: Frontend Dashboard: Unauthenticated callable dispatch and administrator takeover
An unauthenticated caller can select a PHP function or class method and pass request data to it through exposed actions that lack authorization and nonce checks. The export establishes takeover of arbitrary accounts, including administrators, through this attacker-controlled dispatch. It does not name the action identifiers, callable selector, invoked function or account-changing parameters. Affected versions: 3.0.0 to < 3.0.5. The authoritative export identifies 3.0.5 as fixed for this CVE.
| Safe version |
|
||
|---|---|---|---|
| Oct 08, 2026 |
CVE-2026-103692
Frontend Dashboard: Unauthenticated callable dispatch and administrator takeover
An unauthenticated caller can select a PHP function or class method and pass request data to it through exposed actions that lack authorization and nonce checks. The export establishes takeover of arbitrary accounts, including administrators, through this attacker-controlled dispatch. It does not name the action identifiers, callable selector, invoked function or account-changing parameters. Affected versions: 3.0.0 to < 3.0.5. The authoritative export identifies 3.0.5 as fixed for this CVE.
|
3.0.5 |
CVE9.8
NVDPending
|
| Oct 07, 2026 |
CVE-2026-103681
Frontend Dashboard: Subscriber AJAX action deletes configured fields
A low-privilege authenticated user, such as a Subscriber, can call an AJAX action without the required capability check and delete configured profile and post form fields. The action name and selection parameter are undisclosed; the description establishes configuration deletion, not arbitrary filesystem deletion. Affected versions: < 3.0.0. The authoritative export identifies 3.0.0 as fixed for this CVE.
|
3.0.0 |
CVE4.3
NVDPending
|
| Jun 06, 2025 |
CVE-2025-49310
Frontend Dashboard: Cross-site scripting
Frontend Dashboard is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| May 13, 2025 |
CVE-2025-4474
Frontend Dashboard: Privilege escalation or authentication bypass
Frontend Dashboard is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE8.8
NVDPending
|
| May 13, 2025 |
CVE-2025-4473
Frontend Dashboard: Privilege escalation or authentication bypass
Frontend Dashboard is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE8.8
NVDPending
|
| May 07, 2025 |
CVE-2025-4104
Frontend Dashboard: Privilege escalation or authentication bypass
Frontend Dashboard is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE9.8
NVDPending
|
| Apr 24, 2025 |
CVE-2025-46248
Frontend Dashboard: SQL injection
Frontend Dashboard is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE9.3
NVDPending
|
| Sep 10, 2024 |
CVE-2024-8268
Frontend Dashboard: Privilege escalation or authentication bypass
Frontend Dashboard is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Apr 24, 2024 |
CVE-2024-32726
Frontend Dashboard: A security weakness
Frontend Dashboard is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Mar 27, 2024 |
CVE-2024-29775
Frontend Dashboard: Cross-site scripting
Frontend Dashboard is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|