Plugin icon

Advanced Custom Fields: Extended

acf-extended

Vulnerabilities:

6

Last Updated:

May 28, 2026

Active Installs:

100000

Published
Title
Fixed in
CVSS
Published
2026-05-28
Title
Advanced Custom Fields: Extended < 0.9.2.6 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter
Fixed in
Fixed in 0.9.2.6
CVSS
9.8 (critical)
Published
2026-05-12
Title
Advanced Custom Fields: Extended < 0.9.2.4 - Unauthenticated Arbitrary Shortcode Execution
Fixed in
Fixed in 0.9.2.4
CVSS
6.5 (medium)
Published
2026-01-19
Title
Advanced Custom Fields: Extended < 0.9.2.2 - Unauthenticated Privilege Escalation
Fixed in
Fixed in 0.9.2.2
CVSS
8.1 (high)
Published
2025-12-02
Title
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
Fixed in
Fixed in 0.9.2
CVSS
9.8 (critical)
Published
2023-09-29
Title
Advanced Custom Fields: Extended < 0.8.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 0.8.9.4
CVSS
6.4 (medium)
Published
2021-12-24
Title
Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection
Fixed in
Fixed in 0.8.8.7
CVSS
6.8 (medium)