VendorsAdvanced Custom Fieldsadvanced_custom_fieldsall versions
Vulnerabilities

Advanced Custom Fields Advanced Custom Fields

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

15CVEs
CVE-2022-2594
Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload
Published 2022-08-22 · Modified
8.8EPSS 0.016
CVE-2023-1196
Advanced Custom Fields - Contributor+ PHP Object Injection
Published 2023-05-02 · Modified
8.8EPSS 0.011
CVE-2021-20865
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.
Published 2021-12-13 · Modified
7.5EPSS 0.025
CVE-2022-40696
WordPress Advanced Custom Fields Plugin 3.1.1-6.0.2 is vulnerable to Sensitive Data Exposure
Published 2024-01-08 · Modified
7.5EPSS 0.005
CVE-2024-4565
Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access
Published 2024-06-20 · Modified
7.5EPSS 0.004
CVE-2023-30777
WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)
Published 2023-05-10 · Modified
7.1EPSS 0.388
CVE-2024-9529
Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution
Published 2024-11-15 · Analyzed
6.6EPSS 0.004
CVE-2021-20866
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.
Published 2021-12-13 · Modified
6.5EPSS 0.017
CVE-2022-23183
Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission.
Published 2022-03-31 · Modified
6.5EPSS 0.015
CVE-2021-20867
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.
Published 2021-12-13 · Modified
6.5EPSS 0.014
CVE-2023-6701
Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
Published 2024-02-05 · Modified
6.4EPSS 0.005
CVE-2021-24241
Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)
Published 2021-04-22 · Modified
6.1EPSS 0.014
CVE-2020-36172
The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.
Published 2021-01-06 · Modified
6.1EPSS 0.009
CVE-2023-40068
Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.
Published 2023-08-21 · Modified
5.4EPSS 0.020
CVE-2018-20986
The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.
Published 2019-08-22 · Modified
5.4EPSS 0.009