Advisories · Technology

davidvongries Ultimate Dashboard – Custom WordPress Dashboard.

Every CVE that names davidvongries Ultimate Dashboard – Custom WordPress Dashboard among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-3140 CVE record

CVSS 4.3 Medium

Ultimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivation
- davidvongries Ultimate Dashboard – Custom WordPress Dashboard
- Cross-site request forgery (CSRF)
Not analysed yet 1 May 2026
CVE-2025-2276 CVE record

CVSS 4.3 Medium

Ultimate Dashboard <= 3.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Modules Activation/Deactivation
- davidvongries Ultimate Dashboard – Custom WordPress Dashboard
- Broken access control
Not analysed yet 25 Mar 2025
CVE-2023-4726 CVE record

CVSS 4.4 Medium

Ultimate Dashboard <= 3.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
- davidvongries Ultimate Dashboard – Custom WordPress Dashboard
- Cross-site scripting (XSS)
Not analysed yet 22 Nov 2023