Frontend Dashboard

Frontend Dashboard has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 11 are fixed as of October 2026. Their average CVSS score is 7.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 5 high. 2025 was the busiest year with 5 disclosures.

The most common weakness is Improper Authorization, behind 3 of the records (27%). Other recurring categories include Cross-Site Scripting, Improper Privilege Management.

Every one of the 11 issues recorded for Frontend Dashboard has a vendor fix available, so running the current release closes all known holes.

9 independent researchers contributed these findings, most of them (3) reported by kr0d. Frontend Dashboard is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSHigh

7.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Frontend Dashboard vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-4104

Frontend Dashboard 1.0 - 2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation via fed_wp_ajax_fed_login_form_post Function

Read the full analysis

Vulnerability Records

11 records


2026-10-12 00:00	Frontend Dashboard <= 3.0.7 - Authenticated (Subscriber+) Privilege Escalation Frontend Dashboard <= 3.0.7	`CVE-2026-107424`	6.3 Medium	Đỗ Trung Kiên	Yes
2026-10-08 00:00	Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation Frontend Dashboard 3.0.0 – 3.0.4	`CVE-2026-103692`	7.3 High	Ryan Fabella	Yes
2026-10-05 00:00	Frontend Dashboard <= 2.0.0 - Missing Authorization Frontend Dashboard <= 2.0.0	`CVE-2026-103681`	4.3 Medium	Daniel Dhaniswara	Yes
2025-06-05 00:00	Frontend Dashboard <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Frontend Dashboard <= 2.2.8	`CVE-2025-49310`	6.4 Medium	Muhammad Yudha - DJ	Yes
2025-05-12 17:50	Frontend Dashboard 1.0 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via fed_admin_setting_form_function Function Frontend Dashboard 1.0 – 2.2.7	`CVE-2025-4474`	8.8 High	kr0d	Yes
2025-05-12 17:49	Frontend Dashboard 1.5.10 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via ajax_request Function Frontend Dashboard 1.5.10 – 2.2.7	`CVE-2025-4473`	8.8 High	kr0d	Yes
2025-05-06 20:38	Frontend Dashboard 1.0 - 2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation via fed_wp_ajax_fed_login_form_post Function Frontend Dashboard 1.0 – 2.2.6	`CVE-2025-4104`	9.8 Critical	kr0d	Yes
2025-04-22 00:00	Frontend Dashboard <= 2.2.5 - Unauthenticated SQL Injection Frontend Dashboard <= 2.2.5	`CVE-2025-46248`	7.5 High	Nguyen Ngoc Quang Bach (maysbachs)	Yes
2024-09-09 00:00	Frontend Dashboard <= 2.2.4 - Authenticated (Subscriber+) Arbitrary Function Call Frontend Dashboard <= 2.2.4	`CVE-2024-8268`	8.8 High	Lucio Sá	Yes
2024-04-22 00:00	Frontend Dashboard <= 2.2.2 - Sensitive Information Exposure Frontend Dashboard <= 2.2.2	`CVE-2024-32726`	5.3 Medium	Emili Castells	Yes

Showing 1–10 of 11 reports

Latestv3.0.20

Frontend Dashboard

Author

M A Vinoth Kumar

4.9(136)

98/100

Last Updated

2026-10-22 (7d ago)

Active Installs

500+

Downloads

154,674

Requires WP

6.1+

Requires PHP

8.0+

Tested up to

WP 7.1.3

Created

2017-08-09 (9y ago)

Frontend Dashboard — Built for Modern WordPress Portals Frontend Dashboard provides a complete frontend portal for WordPress sites with modular controls for user management, post publishing, custom menus, and branding. Take full control of the user experience by allowing members, authors, and customers to manage their profiles, submit posts, and navigate custom dashboards directly on the frontend — without ever accessing the wp-admin dashboard. Key Features Modern App Shell & Responsive Layout: Clean, fast frontend dashboard interface powered by Tailwind CSS with responsive slide-over navigation. Modern Rich Text & Block Editors: Choose between Editor.js (block editor with headers, images, quotes, lists, tables), TipTap (WYSIWYG modern editor), or the classic WordPress Editor for frontend post publishing. Custom Authentication Flow: Custom Login, Registration, and Forgot Password pages with custom redirects before/after login, register, and logout. WP Admin Restriction: Restrict access to the WordPress backend (/wp-admin/) and admin toolbar based on user roles. Custom User Roles: Create, manage, and assign custom user roles with specific dashboard capabilities. Custom Profile & Post Fields: Create unlimited custom fields for user profiles and post types with role-based visibility and permissions. Built-in Templates & Page Mappings: Built-in modern dashboard templates, extra form fields, and page loaders merged directly into Core. File Upload Controls: Role-based permissions to allow or restrict media uploads in the frontend dashboard. Frontend Post & Taxonomy Management: Add, edit, and delete posts or custom post types and taxonomies with role permissions. Add-ons & Extensions Hub: Browse, install, and activate official Frontend Dashboard add-ons with 1-click management and real-time catalog updates. System Status & Diagnostics: Built-in system environment diagnostic tools, database health checks, and activity logging. Theme Matching & Custom Styling: Customize dashboard theme colors and UI options to seamlessly match your site design. Official Add-ons & Extensions Custom Post and Taxonomies (Free) Notification (Free) Captcha (Free) Social Chat (Free) Frontend Dashboard for WooCommerce (Free) Membership (Pro) Pay Per Post (Pro) User Management (Pro) Social Connect (Pro) Note: Frontend Dashboard Templates, Extra, and Pages have been merged directly into Core in v3.0.0.

View on WordPress.org