WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
acf-extended
Published
2026-10-21
Title
Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes
Slug
acf-extended
Published
2026-10-21
Title
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action
Slug
acf-extended
Published
2026-10-20
Title
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated Arbitrary File Deletion
Slug
acf-extended
Published
2026-10-30
Title
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated Sensitive Data Disclosure via {get_user} Template Tag Injection
Slug
acf-extended
Published
2026-10-26
Title
Advanced Custom Fields: Extended < 0.9.2.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field
Slug
acf-extended
Published
2026-10-21
Title
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
Slug
acf-extended
Published
2026-10-27
Title
Advanced Custom Fields: Extended < 0.9.2.8 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints
Slug
acf-extended-pro
Published
2026-10-21
Title
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action
Slug
acf-extended-pro
Published
2026-10-21
Title
Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message
Slug
acf-extended-pro
Published
2026-10-21
Title
Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes
Slug
acf-extended-pro
Published
2026-10-21
Title
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action
Slug
acf-extended-pro
Published
2026-10-21
Title
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
Slug
acf-extended-pro
Published
2026-09-14
Title
Advanced Custom Fields: Extended PRO < 0.9.2.7 - Unauthenticated Remote Code Execution via Dynamic Render Field Type
Slug
acf-field-blocks
Published
2026-07-08
Title
Blocks for ACF Fields < 1.6.3 - Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'id' Parameter
Slug
acf-flexible-layouts-manager
Published
2025-11-17
Title
ACF Flexible Layouts Manager <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update
Slug
acf-for-woocommerce-product
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
acf-for-woocommerce-product
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
acf-front-end-editor
Published
2024-04-29
Title
ACF Front End Editor <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update
Slug
acf-frontend-display
Published
2015-07-06
Title
ACF Frontend Display <= 2.0.6 - Arbitrary File Upload
Slug
acf-frontend-form-element
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
acf-frontend-form-element
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
acf-frontend-form-element
Published
2023-12-27
Title
Frontend Admin by DynamiApps Plugin < 3.18.4 - Unauthenticated Arbitrary File Upload
Slug
acf-frontend-form-element
Published
2024-04-18
Title
Frontend Admin by DynamiApps < 3.19.5 - Improper Missing Encryption Exception Handling to Form Manipulation
Slug
acf-frontend-form-element
Published
2024-12-13
Title
Frontend Admin by DynamiApps < 3.25.1 - Unauthenticated Stored Cross-Site Scripting
Slug
acf-frontend-form-element
Published
2024-12-13
Title
Frontend Admin by DynamiApps < 3.25.1 - Unauthenticated Privilege Escalation