WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
accurate-form-data-real-time-form-validation
Published
2015-08-04
Title
WP Accurate Form Data <= 1.2 - Cross-Site Scripting (XSS) & CSRF
Slug
ace-post-type-builder
Published
2025-11-24
Title
Ace Post Type Builder < 2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Custom Taxonomy Deletion via 'taxonomy' Parameter
Slug
ace-user-management
Published
2025-10-15
Title
Ace User Management <= 2.0.3 - Subscriber+ Authentication Bypass via Password Rest
Slug
aceide
Published
2021-07-24
Title
AceIDE <= 2.6.2 - Authenticated (admin+) Arbitrary File Access
Slug
acf-better-search
Published
2019-06-27
Title
ACF Better Search <= 3.3.0 - Cross-Site Request Forgery (CSRF)
Slug
acf-blocks
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
acf-blocks
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
acf-blocks
Published
2025-06-19
Title
Gutenberg Blocks – ACF Blocks Suite <= 2.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
acf-city-selector
Published
2024-12-30
Title
ACF City Selector < 1.15.0 - Authenticated (Admin+) Arbitrary File Upload
Slug
acf-city-selector
Published
2025-04-01
Title
ACF City Selector <= 1.19.0 - Unauthenticated Sensitive Information Exposure
Slug
acf-cpt-options-pages
Published
2025-09-21
Title
Advanced Custom Fields : CPT Options Pages <= 2.0.9 - Cross-Site Request Forgery
Slug
acf-engine
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
acf-extended
Published
2021-12-24
Title
Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection
Slug
acf-extended
Published
2023-09-29
Title
Advanced Custom Fields: Extended < 0.8.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
acf-extended
Published
2025-12-02
Title
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
Slug
acf-extended
Published
2026-01-19
Title
Advanced Custom Fields: Extended < 0.9.2.2 - Unauthenticated Privilege Escalation
Slug
acf-extended
Published
2026-05-12
Title
Advanced Custom Fields: Extended < 0.9.2.4 - Unauthenticated Arbitrary Shortcode Execution
Slug
acf-extended
Published
2026-05-28
Title
Advanced Custom Fields: Extended < 0.9.2.6 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter
Slug
acf-extended
Published
2026-08-27
Title
Advanced Custom Fields: Extended < 0.9.2.7 - Missing Authorization
Slug
acf-extended
Published
2026-08-31
Title
Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
Slug
acf-extended
Published
2026-08-31
Title
Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action
Slug
acf-extended
Published
2026-10-20
Title
Advanced Custom Fields: Extended < 0.9.2.8 - Missing Authorization
Slug
acf-extended
Published
2026-10-20
Title
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated Stored XSS
Slug
acf-extended
Published
2026-10-21
Title
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action
Slug
acf-extended
Published
2026-10-21
Title
Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message