WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
acf-frontend-form-element
Published
2025-02-23
Title
Frontend Admin by DynamiApps < 3.25.18 - Reflected Cross-Site Scripting
Slug
acf-frontend-form-element
Published
2025-06-26
Title
Frontend Admin by DynamiApps < 3.28.8 - Authenticated (Editor+) Arbitrary File Deletion
Slug
acf-frontend-form-element
Published
2025-08-12
Title
Frontend Admin by DynamiApps < 3.28.5 - Authenticated (Subscriber+) SQL Injection
Slug
acf-frontend-form-element
Published
2025-12-03
Title
Frontend Admin by DynamiApps < 3.28.21 - Unauthenticated Arbitrary Options Update
Slug
acf-frontend-form-element
Published
2026-01-08
Title
Frontend Admin by DynamiApps < 3.28.30 - Unauthenticated Privilege Escalation to Administrator via Role Form Field
Slug
acf-frontend-form-element
Published
2026-01-08
Title
Frontend Admin by DynamiApps < 3.28.24 - Unauthenticated Stored Cross-Site Scripting via 'update_field'
Slug
acf-frontend-form-element
Published
2026-01-08
Title
Frontend Admin by DynamiApps < 3.28.26 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element
Slug
acf-frontend-form-element
Published
2026-03-25
Title
Frontend Admin by DynamiApps < 3.28.32 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts
Slug
acf-galerie-4
Published
2026-04-23
Title
ACF Galerie 4 < 1.4.3 - Missing Authorization
Slug
acf-google-font-selector-field
Published
2025-04-21
Title
ACF: Google Font Selector <= 3.0.1 - Reflected Cross-Site Scripting
Slug
acf-images-search-and-insert
Published
2024-10-09
Title
ACF Images Search And Insert <= 1.1.4 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
acf-link-picker-field
Published
2025-04-11
Title
Advanced Custom Fields: Link Picker Field <= 1.2.8 - Reflected Cross-Site Scripting
Slug
acf-on-the-go
Published
2024-04-29
Title
ACF On-The-Go <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update
Slug
acf-onyx-poll
Published
2025-06-12
Title
ACF Onyx Poll < 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
Slug
acf-options-importexport
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
acf-quickedit-fields
Published
2022-12-05
Title
ACF Quick Edit Fields < 3.2.3 - Contributor+ User Metadata Leak via IDOR
Slug
acf-recent-posts-widget
Published
2025-08-30
Title
ACF Recent Posts Widget <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
acf-to-rest-api
Published
2020-06-28
Title
ACF to REST API < 3.3.0 - Unauthenticated Arbitrary wp_options Disclosure
Slug
acf-to-rest-api
Published
2025-10-20
Title
ACF to REST API <= 3.3.4 - Unauthenticated Information Exposure
Slug
acf-to-rest-api
Published
2026-01-06
Title
ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification
Slug
acf-vc-integrator
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
acf-views
Published
2025-09-22
Title
Advanced Views < 3.7.20 - Author+ Remote Code Execution via SSTI
Slug
acf-yandex-maps-field
Published
2025-06-05
Title
ACF: Yandex Maps Field <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
ach-for-stripe-plaid
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
ach-invoice-app
Published
2025-01-03
Title
Ach Invoice App <= 1.0.1 - Unauthenticated Local File Inclusion