WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
acf-google-font-selector-field
Published
2025-04-21
Title
ACF: Google Font Selector <= 3.0.1 - Reflected Cross-Site Scripting
Slug
acf-images-search-and-insert
Published
2024-10-09
Title
ACF Images Search And Insert <= 1.1.4 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
acf-link-picker-field
Published
2025-04-11
Title
Advanced Custom Fields: Link Picker Field <= 1.2.8 - Reflected Cross-Site Scripting
Slug
acf-on-the-go
Published
2024-04-29
Title
ACF On-The-Go <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update
Slug
acf-onyx-poll
Published
2025-06-12
Title
ACF Onyx Poll < 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
Slug
acf-options-importexport
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
acf-quickedit-fields
Published
2022-12-05
Title
ACF Quick Edit Fields < 3.2.3 - Contributor+ User Metadata Leak via IDOR
Slug
acf-recent-posts-widget
Published
2025-08-30
Title
ACF Recent Posts Widget <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
acf-to-rest-api
Published
2020-06-28
Title
ACF to REST API < 3.3.0 - Unauthenticated Arbitrary wp_options Disclosure
Slug
acf-to-rest-api
Published
2025-10-20
Title
ACF to REST API <= 3.3.4 - Unauthenticated Information Exposure
Slug
acf-to-rest-api
Published
2026-01-06
Title
ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification
Slug
acf-vc-integrator
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
acf-views
Published
2025-09-22
Title
Advanced Views < 3.7.20 - Author+ Remote Code Execution via SSTI
Slug
acf-yandex-maps-field
Published
2025-06-05
Title
ACF: Yandex Maps Field <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
ach-for-stripe-plaid
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
ach-invoice-app
Published
2025-01-03
Title
Ach Invoice App <= 1.0.1 - Unauthenticated Local File Inclusion
Slug
achilles-shortcodes
Published
2024-11-08
Title
AchillesTheme-shortcodes <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
acknowledgify
Published
2025-10-16
Title
Acknowledgify < 1.1.4 - Missing Authorization
Slug
acl-floating-cart-for-woocommerce
Published
2024-10-21
Title
ACL Floating Cart for WooCommerce <= 0.9 - Reflected Cross-Site Scripting
Slug
acme-divi-modules
Published
2025-03-31
Title
ACME Divi Modules <= 1.3.5 - Missing Authorization
Slug
acme-fix-images
Published
2023-11-15
Title
Acme Fix Images < 2.0.0 - Subscriber+ Image Resizing
Slug
acnoo-flutter-api
Published
2024-10-25
Title
Acnoo Flutter API <= 1.0.5 - Authentication Bypass
Slug
aco-product-labels-for-woocommerce
Published
2024-02-05
Title
Product Labels For Woocommerce < 1.5.4 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Slug
aco-product-labels-for-woocommerce
Published
2024-12-02
Title
Product Labels For Woocommerce < 1.5.9 - Authenticated (Administrator+) SQL Injection
Slug
aco-product-labels-for-woocommerce
Published
2025-03-03
Title
Product Labels For Woocommerce < 1.5.11 - Admin+ SQLi