WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
acf-cpt-options-pages
Published
2025-09-21
Title
Advanced Custom Fields : CPT Options Pages <= 2.0.9 - Cross-Site Request Forgery
Slug
acf-engine
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
acf-extended
Published
2021-12-24
Title
Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection
Slug
acf-extended
Published
2023-09-29
Title
Advanced Custom Fields: Extended < 0.8.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
acf-extended
Published
2025-12-02
Title
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
Slug
acf-extended
Published
2026-01-19
Title
Advanced Custom Fields: Extended < 0.9.2.2 - Unauthenticated Privilege Escalation
Slug
acf-flexible-layouts-manager
Published
2025-11-17
Title
ACF Flexible Layouts Manager <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update
Slug
acf-for-woocommerce-product
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
acf-for-woocommerce-product
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
acf-front-end-editor
Published
2024-04-29
Title
ACF Front End Editor <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update
Slug
acf-frontend-display
Published
2015-07-06
Title
ACF Frontend Display <= 2.0.6 - Arbitrary File Upload
Slug
acf-frontend-form-element
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
acf-frontend-form-element
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
acf-frontend-form-element
Published
2023-12-27
Title
Frontend Admin by DynamiApps Plugin < 3.18.4 - Unauthenticated Arbitrary File Upload
Slug
acf-frontend-form-element
Published
2024-04-18
Title
Frontend Admin by DynamiApps < 3.19.5 - Improper Missing Encryption Exception Handling to Form Manipulation
Slug
acf-frontend-form-element
Published
2024-12-13
Title
Frontend Admin by DynamiApps < 3.25.1 - Unauthenticated Stored Cross-Site Scripting
Slug
acf-frontend-form-element
Published
2024-12-13
Title
Frontend Admin by DynamiApps < 3.25.1 - Unauthenticated Privilege Escalation
Slug
acf-frontend-form-element
Published
2024-12-20
Title
Frontend Admin by DynamiApps < 3.25.2 - Unauthenticated SQL Injection
Slug
acf-frontend-form-element
Published
2025-02-23
Title
Frontend Admin by DynamiApps < 3.25.18 - Reflected Cross-Site Scripting
Slug
acf-frontend-form-element
Published
2025-06-26
Title
Frontend Admin by DynamiApps < 3.28.8 - Authenticated (Editor+) Arbitrary File Deletion
Slug
acf-frontend-form-element
Published
2025-08-12
Title
Frontend Admin by DynamiApps < 3.28.5 - Authenticated (Subscriber+) SQL Injection
Slug
acf-frontend-form-element
Published
2025-12-03
Title
Frontend Admin by DynamiApps < 3.28.21 - Unauthenticated Arbitrary Options Update
Slug
acf-frontend-form-element
Published
2026-01-08
Title
Frontend Admin by DynamiApps < 3.28.26 - Unauthenticated Privilege Escalation to Administrator via Role Form Field
Slug
acf-frontend-form-element
Published
2026-01-08
Title
Frontend Admin by DynamiApps < 3.28.24 - Unauthenticated Stored Cross-Site Scripting via 'update_field'
Slug
acf-frontend-form-element
Published
2026-01-08
Title
Frontend Admin by DynamiApps < 3.28.26 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element