Frontend Dashboard
Approved changes feed: RSS · Atom
cpe:2.3:a:vinoth06:frontend_dashboard:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Vinoth06 (53500700-5670-5fee-a2f7-0cace518f9c6) |
|---|---|
| Product | Frontend Dashboard (0e661516-903f-52bd-9642-bc1c1d72ce60) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-4474 |
vulnerable | 2026-06-08 07:29:16.290019 |
Frontend Dashboard 1.0 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via fed_admin_setting_form_function Function
HIGH (8.8)
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_admin_setting_form_function() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin’s 'register' role setting to make new user registrations default to the administrator role, leading to an elevation of privileges to that of an administrator.
Published: 2025-05-13T06:40:56.651Z
Updated: 2025-05-13T13:16:32.178Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-4473 |
vulnerable | 2026-06-08 07:29:16.289735 |
Frontend Dashboard 1.5.10 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via ajax_request Function
HIGH (8.8)
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_request() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to control where the plugin sends outgoing emails. By pointing SMTP to their own server, attackers could capture password reset emails intended for administrators, and elevate their privileges for full site takeover.
Published: 2025-05-13T06:40:54.828Z
Updated: 2025-05-13T13:53:38.690Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-4104 |
vulnerable | 2026-06-08 07:29:15.413135 |
Frontend Dashboard 1.0 - 2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation via fed_wp_ajax_fed_login_form_post Function
CRITICAL (9.8)
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_wp_ajax_fed_login_form_post() function in versions 1.0 to 2.2.6. This makes it possible for unauthenticated attackers to reset the administrator’s email and password, and elevate their privileges to that of an administrator.
Published: 2025-05-07T09:21:44.603Z
Updated: 2025-05-07T13:29:49.041Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8268 |
vulnerable | 2026-06-08 07:00:23.453249 |
Frontend Dashboard <= 2.2.4 - Authenticated (Subscriber+) Arbitrary Function Call
HIGH (8.8)
The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the ajax_request() function in all versions up to, and including, 2.2.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to call arbitrary functions that can be leverage for privilege escalation by changing user's passwords.
Published: 2024-09-10T02:05:10.921Z
Updated: 2026-04-08T17:02:54.880Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.