CVEs we hold for Shabti
Records whose assigning authority named Shabti as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-7802Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via…shabti Frontend Admin by DynamiApps
CVE-2026-75816Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifiershabti Frontend Admin by DynamiApps
CVE-2026-66662WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerabilityShabti Kaplan Frontend Admin by DynamiApps
CVE-2026-66638WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerabilityShabti Kaplan Frontend Admin by DynamiApps
CVE-2026-66470WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerabilityShabti Kaplan Frontend Admin by DynamiApps
CVE-2026-6228Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Formshabti Frontend Admin by DynamiApps
CVE-2026-6226Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injectionshabti Frontend Admin by DynamiApps
CVE-2026-3328Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form…shabti Frontend Admin by DynamiApps
CVE-2026-19952Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via…shabti Frontend Admin by DynamiApps
CVE-2026-18432Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parametershabti Frontend Admin by DynamiApps
CVE-2026-15606Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Tokenshabti Frontend Admin by DynamiApps
CVE-2026-12747Frontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode…shabti Frontend Admin by DynamiApps
CVE-2026-10039Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parametershabti Frontend Admin by DynamiApps
CVE-2025-49303WordPress Frontend Admin by DynamiApps plugin <= 3.28.7 - Arbitrary File Download VulnerabilityShabti Kaplan Frontend Admin by DynamiApps
CVE-2025-49267WordPress Frontend Admin by DynamiApps plugin <= 3.28.3 - SQL Injection vulnerabilityShabti Kaplan Frontend Admin by DynamiApps
CVE-2025-26987WordPress Frontend Admin by DynamiApps plugin <= 3.25.17 - Reflected Cross Site Scripting (XSS) vulnerabilityShabti Kaplan Frontend Admin by DynamiApps
CVE-2025-14937Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field'shabti Frontend Admin by DynamiApps
CVE-2025-14741Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete…shabti Frontend Admin by DynamiApps
CVE-2025-14736Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Fieldshabti Frontend Admin by DynamiApps
CVE-2025-13342Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Updateshabti Frontend Admin by DynamiApps
CVE-2024-3729Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulationshabti Frontend Admin by DynamiApps
CVE-2024-11722Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injectionshabti Frontend Admin by DynamiApps
CVE-2024-11721Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalationshabti Frontend Admin by DynamiApps
CVE-2024-11720Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site Scriptingshabti Frontend Admin by DynamiApps
CVE-2023-51411WordPress Frontend Admin by DynamiApps Plugin <= 3.18.3 is vulnerable to Arbitrary File UploadShabti Kaplan Frontend Admin by DynamiApps
25 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.