Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-03
Advanced Custom Fields - Security Vulnerability (CVE-2026-120534)
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL…
PLUGIN
Advanced Custom Fields
CVE-2026-120534
Risk Score
Threat Entry
Updated 2026-10-23
Advanced Custom Fields - Security Vulnerability (CVE-2026-94263)
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
PLUGIN
Advanced Custom Fields
CVE-2026-94263
Risk Score
Threat Entry
Updated 2026-07-22
Advanced Custom Fields - Broken Access Control (CVE-2026-8382)
The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the post_title and post_content of any post bound to a publicly accessible acf_form() instance by injecting values into the _post_title and _post_content parameters of a form submission request.
PLUGIN
Advanced Custom Fields
CVE-2026-8382
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Cross-Site Scripting (XSS) (CVE-2026-6415)
The Advanced Custom Fields: Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.0.2. This is due to insufficient input validation of JSON field values and unsafe client-side HTML construction in the update_preview() JavaScript function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Advanced Custom Fields
CVE-2026-6415
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Broken Access Control (CVE-2026-4812)
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions without proper authorization checks. This makes it possible for unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information about draft/private posts, restricted post types, and other data that should be restricted by field configuration.
PLUGIN
Advanced Custom Fields
CVE-2026-4812
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Cross-Site Scripting (XSS) (CVE-2025-14983)
The Advanced Custom Fields: Font Awesome Field plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts that execute in a victim's browser.
PLUGIN
Advanced Custom Fields
CVE-2025-14983
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Security Vulnerability (CVE-2024-9529)
The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
PLUGIN
Advanced Custom Fields
CVE-2024-9529
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Cross-Site Scripting (XSS) (CVE-2024-49593)
In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the free version of ACF, then you can follow the process shown at the advancedcustomfields.com blog URL within the References section below.
PLUGIN
Advanced Custom Fields
CVE-2024-49593
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Cross-Site Scripting (XSS) (CVE-2024-45429)
Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker's.
PLUGIN
Advanced Custom Fields
CVE-2024-45429
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Security Vulnerability (CVE-2024-4565)
The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access
PLUGIN
Advanced Custom Fields
CVE-2024-4565
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Cross-Site Scripting (XSS) (CVE-2023-6701)
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Advanced Custom Fields
CVE-2023-6701
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Information Disclosure (CVE-2022-40696)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.
PLUGIN
Advanced Custom Fields
CVE-2022-40696
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Cross-Site Scripting (XSS) (CVE-2023-40068)
Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.
PLUGIN
Advanced Custom Fields
CVE-2023-40068
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Cross-Site Scripting (XSS) (CVE-2023-30777)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins
PLUGIN
Advanced Custom Fields
CVE-2023-30777
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - PHP Object Injection (CVE-2023-1196)
The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.
PLUGIN
Advanced Custom Fields
CVE-2023-1196
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Security Vulnerability (CVE-2022-2594)
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.
PLUGIN
Advanced Custom Fields
CVE-2022-2594
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Broken Access Control (CVE-2022-23183)
Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission.
PLUGIN
Advanced Custom Fields
CVE-2022-23183
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Broken Access Control (CVE-2021-20867)
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.
PLUGIN
Advanced Custom Fields
CVE-2021-20867
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Broken Access Control (CVE-2021-20865)
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.
PLUGIN
Advanced Custom Fields
CVE-2021-20865
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Custom Fields - Broken Access Control (CVE-2021-20866)
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.
PLUGIN
Advanced Custom Fields
CVE-2021-20866
Risk Score