WordPress Advanced Custom Fields Plugin < 5.11 is vulnerable to Broken Access Control<\/p>
Software: Advanced Custom Fields<\/p>
Link: https:\/\/wordpress.org\/plugins\/advanced-custom-fields\/#developers<\/p>
Affected Version < 5.11<\/p>
Fixed in version 5.11 <\/p>","date":"2024-10-04"},{"id":"3db83e680dfc25f695642b304939b28173b4147f","name":"WordPress Advanced Custom Fields PRO Plugin < 5.11 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields-pro\/vulnerability\/wordpress-advanced-custom-fields-pro-plugin-5-11-missing-authorization-to-information-disclosure-vulnerability","description":"
WordPress Advanced Custom Fields PRO Plugin < 5.11 is vulnerable to Broken Access Control<\/p>
Affected Version < 5.11<\/p>
Fixed in version 5.11 <\/p>","date":"2024-10-04"},{"id":"EUVD-2021-8274","name":"EUVD-2021-8274","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2021-8274","description":"Malicious code in bioql (PyPI)","date":"2025-10-03"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"n","a":"n","score":"7.5","severity":"h","exploitable":"3.9","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N","score":"7.5","severity":"high","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"none","a":"none","exploitable":"3.9","impact":"3.6"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"epss":"0.006"}},{"uuid":"7c59e9059ec81c63849a31303ed560d30585eaa5fc830cbfe827869d705c34af","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 5.11","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.11","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-20866","name":"CVE-2021-20866","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-20866","description":"[en] Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.","date":"2021-12-13"},{"id":"JVNDB-2021-000109","name":"Multiple missing authorization vulnerabilities in WordPress Plugin \"Advanced Custom Fields\"","link":"http:\/\/jvndb.jvn.jp\/jvndb\/JVNDB-2021-000109","description":"WordPress Plugin \"Advanced Custom Fields\" provided by Delicious Brains contains multiple missing authorization vulnerabilities listed below. * Missing authorization related to database browsing (CWE-862) - CVE-2021-20865 * Missing authorization related to user list obtaining (CWE-862) - CVE-2021-20866 * Missing authorization related to field group movement (CWE-862) - CVE-2021-20867 Keitaro Yamazaki of Ierae Security, Inc reported these vulnerabilities to IPA. JPCERT\/CC coordinated with the developer under Information Security Early Warning Partnership.","date":"2021-12-02"},{"id":"58a10d42f65de507381399ac2db49d07491d2f76","name":"Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/advanced-custom-fields-510-missing-authorization-to-information-disclosure-2","description":"Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.","date":"2021-12-02"},{"id":"177f1de7b847d9e3b6467180d87e93d2271293b6","name":"WordPress Advanced Custom Fields Plugin < 5.11 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-5-11-missing-authorization-to-information-disclosure-vulnerability-2","description":"
WordPress Advanced Custom Fields Plugin < 5.11 is vulnerable to Broken Access Control<\/p>
Software: Advanced Custom Fields<\/p>
Link: https:\/\/wordpress.org\/plugins\/advanced-custom-fields\/#developers<\/p>
Affected Version < 5.11<\/p>
Fixed in version 5.11 <\/p>","date":"2024-10-04"},{"id":"1563da079eeaf9795fb5256f39dd7776ef5dfd6f","name":"WordPress Advanced Custom Fields PRO Plugin < 5.11 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields-pro\/vulnerability\/wordpress-advanced-custom-fields-pro-plugin-5-11-missing-authorization-to-information-disclosure-vulnerability-2","description":"
WordPress Advanced Custom Fields PRO Plugin < 5.11 is vulnerable to Broken Access Control<\/p>
Affected Version < 5.11<\/p>
Fixed in version 5.11 <\/p>","date":"2024-10-04"},{"id":"EUVD-2021-8275","name":"EUVD-2021-8275","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2021-8275","description":"Malicious code in bioql (PyPI)","date":"2025-10-03"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:N\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"h","i":"n","a":"n","score":"6.5","severity":"m","exploitable":"2.8","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:N\/A:N","score":"6.5","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"high","i":"none","a":"none","exploitable":"2.8","impact":"3.6"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"epss":"0.004"}},{"uuid":"dabe6084e0cdddea025e18fb83f2a782399dcfe17c6552646640193f226142b2","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 5.12.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.12.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-20867","name":"CVE-2021-20867","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-20867","description":"[en] Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.","date":"2021-12-13"},{"id":"JVNDB-2021-000109","name":"Multiple missing authorization vulnerabilities in WordPress Plugin \"Advanced Custom Fields\"","link":"http:\/\/jvndb.jvn.jp\/jvndb\/JVNDB-2021-000109","description":"WordPress Plugin \"Advanced Custom Fields\" provided by Delicious Brains contains multiple missing authorization vulnerabilities listed below. * Missing authorization related to database browsing (CWE-862) - CVE-2021-20865 * Missing authorization related to user list obtaining (CWE-862) - CVE-2021-20866 * Missing authorization related to field group movement (CWE-862) - CVE-2021-20867 Keitaro Yamazaki of Ierae Security, Inc reported these vulnerabilities to IPA. JPCERT\/CC coordinated with the developer under Information Security Early Warning Partnership.","date":"2021-12-02"},{"id":"f322619a-e85d-4931-8785-eb9cf30cef7f","name":"Advanced Custom Fields < 5.11 - Subscriber+ Arbitrary ACF Data\/Field Groups View and Fields Move","link":"https:\/\/wpscan.com\/vulnerability\/f322619a-e85d-4931-8785-eb9cf30cef7f","description":"Some of the functions did not have proper capability checks in place, allowing low privilege users such as subscribers to view arbitrary ACF data, movie fields, as well as view field groups.","date":null},{"id":"10dbcb9c76ee47d898768fd9142014ca00932319","name":"Advanced Custom Fields <= 5.10 - Missing Authorization on Option Changes","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/advanced-custom-fields-510-missing-authorization-on-option-changes","description":"Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.","date":"2021-12-02"},{"id":"f01604c2e603988b5ccbb6a8b963e1f714f7e432","name":"WordPress Advanced Custom Fields Plugin < 5.11 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-5-10-missing-authorization-on-option-changes-vulnerability","description":"
WordPress Advanced Custom Fields Plugin < 5.11 is vulnerable to Broken Access Control<\/p>
Software: Advanced Custom Fields<\/p>
Link: https:\/\/wordpress.org\/plugins\/advanced-custom-fields\/#developers<\/p>
Affected Version < 5.11<\/p>
Fixed in version 5.11 <\/p>","date":"2024-10-04"},{"id":"EUVD-2021-8276","name":"EUVD-2021-8276","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2021-8276","description":"Malicious code in bioql (PyPI)","date":"2025-10-03"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:H\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"n","i":"h","a":"n","score":"6.5","severity":"m","exploitable":"2.8","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:H\/A:N","score":"6.5","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"high","a":"none","exploitable":"2.8","impact":"3.6"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"epss":"0.002"}},{"uuid":"86776dece6ed26340fb1b3b648c3d13becdb696a61d68d00e1145d76edf0cd56","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 5.8.12","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.8.12","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2020-36172","name":"CVE-2020-36172","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2020-36172","description":"[en] The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.","date":"2021-01-06"},{"id":"2b6fcfa5fe1b757c93fe20696ce1dc6d5ea5fe2b","name":"WordPress Advanced Custom Fields plugin <= 5.8.11 - Cross-Site Scripting (XSS) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-5-8-11-cross-site-scripting-xss-vulnerability","description":"Cross-Site Scripting (XSS) vulnerability found in WordPress Advanced Custom Fields plugin (versions <= 5.8.11).","date":"2020-06-21"},{"id":"daa26c20-4295-40a3-b06f-62b22a635083","name":"Advanced Custom Fields < 5.8.12 - Cross-Site Scripting in Select2 dropdowns","link":"https:\/\/wpscan.com\/vulnerability\/daa26c20-4295-40a3-b06f-62b22a635083","description":"The plugin did not correctly escape input from Select2 dropdowns, which could lead to Cross-Site Scripting issues","date":null},{"id":"95275d973ec8d5b61b3b0d5e93ba8b738e4eee5d","name":"Advanced Custom Fields <= 5.8.11 - Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/advanced-custom-fields\/advanced-custom-fields-5811-cross-site-scripting","description":"The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.","date":"2020-06-10"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"dbb0a18e007ebcb3369157c7efde79807a017452b69c646870f261f79e6a0d77","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 5.7.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.7.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2018-20986","name":"CVE-2018-20986","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2018-20986","description":"[en] The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.","date":"2019-08-22"},{"id":"a90020b3-1d8f-4278-93f4-a3263e3bbdcd","name":"Advanced Custom Fields <= 5.7.7 - Authenticated Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/a90020b3-1d8f-4278-93f4-a3263e3bbdcd","description":"According to the vendor:\r\n\r\n"This release contains a fix to a recently reported XSS vunerability [sic]. This report showed it was possible for a logged in author to save unfiltered HTML within a custom field value. This is something that should not be possible without the unfiltered_html capability."","date":null},{"id":"5b5576e428381346cde08bcc5ba3fbda5728759b","name":"Advanced Custom Fields <= 5.7.7 - Author+ Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/advanced-custom-fields\/advanced-custom-fields-577-author-stored-cross-site-scripting","description":"The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.","date":"2018-12-07"}],"impact":{"cvss":{"version":"3.0","vector":"CVSS:3.0\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"5.4","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.0","vector":"CVSS:3.0\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"4086d0d723e19ddb2c19f46357f83a88c3fba06dfaf4109905a7434be0566c44","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 5.12.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.12.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2022-23183","name":"CVE-2022-23183","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-23183","description":"[en] Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission.","date":"2022-03-31"},{"id":"JVNDB-2022-000023","name":"WordPress Plugin \"Advanced Custom Fields\" vulnerable to missing authorization","link":"http:\/\/jvndb.jvn.jp\/jvndb\/JVNDB-2022-000023","description":"WordPress Plugin \"Advanced Custom Fields\" provided by Delicious Brains contains a missing authorization vulnerability (CWE-862). Keitaro Yamazaki of Ierae Security, Inc. reported this vulnerability to IPA. JPCERT\/CC coordinated with the developer under Information Security Early Warning Partnership.","date":"2022-03-30"},{"id":"0102ab8913c828346770d72dae472fb17c179774","name":"WordPress Advanced Custom Fields plugin <= 5.12 - Database Information Access vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-5-12-database-information-access-vulnerability","description":"Database Information Access vulnerability was discovered by Keitaro Yamazaki (Ierae Security Inc) in the WordPress Advanced Custom Fields plugin (versions <= 5.12).","date":"2022-03-30"},{"id":"413576a8-0f20-465e-80cf-7cb0cb22bded","name":"Advanced Custom Fields < 5.12.1 - Contributor+ Database Information Access","link":"https:\/\/wpscan.com\/vulnerability\/413576a8-0f20-465e-80cf-7cb0cb22bded","description":"The plugin does not have proper authorisation which could allow users with a role as low as contributor to view information on the database without the access permission","date":null},{"id":"6fcd47bab269dea571095163a50e1a2334c8f168","name":"Advanced Custom Fields <= 5.12 - Authenticated Information Disclosure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/advanced-custom-fields-512-authenticated-information-disclosure","description":"The Advanced Custom Fields plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 5.12. This makes it possible for authenticated attackers with editor access, such as Contributors and above, to view information in the database without the appropriate authorization.","date":"2022-03-30"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:N\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"h","i":"n","a":"n","score":"6.5","severity":"m","exploitable":"2.8","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:N\/A:N","score":"6.5","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"high","i":"none","a":"none","exploitable":"2.8","impact":"3.6"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}]}},{"uuid":"fc28a35cc35083004d7df506d801020a8d74cd78dd6b57fbdc8222ebdcdea0ee","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 5.10","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.10","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"78d40e5a923cc870d6a6d966d7a8d0f03db5e305","name":"WordPress Advanced Custom Fields plugin <= 5.9.9 - Arbitrary ACF Data\/Field Groups View and Fields Move vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-5-9-9-arbitrary-acf-data-field-groups-view-and-fields-move-vulnerability","description":"Arbitrary ACF Data\/Field Groups View and Fields Move vulnerability discovered by Keitaro Yamazaki in WordPress Advanced Custom Fields plugin (versions <= 5.9.9).","date":"2021-08-25"}],"impact":[]},{"uuid":"91eef964281471f04e3fa92ef5030f38a1d6ffbc688b4e9a9a8d97fafd5d717e","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 5.7.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.7.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"ef9b95d7681cd08524715dc550788d18edb15e8b","name":"WordPress Advanced Custom Fields plugin <= 5.7.7 - Authenticated Cross-Site Scripting (XSS) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-5-7-7-authenticated-cross-site-scripting-xss-vulnerability","description":"Authenticated Cross-Site Scripting (XSS) vulnerability found by Loading Kura Kura in WordPress Advanced Custom Fields plugin (versions <= 5.7.7).","date":"2018-12-10"}],"impact":[]},{"uuid":"20dff45ce4cc502fb142cce67a21c50e5c10289e50f152cedc7da54062dffd97","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 1.1.13","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.1.13","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"4b617a5651780008253fcd9e03a80d359539f2ff","name":"WordPress Advanced Custom Fields Plugin <= 1.1.12 - Stored Cross Site Scripting","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-1-1-12-stored-cross-site-scripting","description":"Because of this vulnerability, users can inject JavaScript into pages within \/wp-admin\/.\nUpgrade the plugin.","date":"2016-08-08"}],"impact":[]},{"uuid":"cd6ac19afd944e401759168ba90a05b16789c344459fb25142b15435951a0af5","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 3.5.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.5.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"0ad46576822d1fbcb329c1e4d8d2145637edffea","name":"WordPress Advanced Custom Fields Plugin - Remote File Inclusion","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-remote-file-inclusion","description":"WordPress Advanced Custom Fields plugin is prone to a remote file inclusion vulnerability. It allows for remote file inclusion and remote code execution via the export.php script.\nUpdate the plugin.","date":"2013-01-03"}],"impact":[]},{"uuid":"ab8f5a7ad5cb01f88417cf58bacdb07c2c1af9ae678617c5d3ecb00cdcac19f0","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 5.12.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.12.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2022-2594","name":"CVE-2022-2594","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-2594","description":"[en] The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.","date":"2022-08-22"},{"id":"5baecc08d79eb2c46a207fc1e446de27495b0c34","name":"WordPress Advanced Custom Fields plugin <= 5.12.2 - Unauthenticated File Upload vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-5-12-2-unauthenticated-file-upload-vulnerability","description":"Unauthenticated File Upload vulnerability discovered by James Golovich in WordPress Advanced Custom Fields plugin (versions <= 5.12.2).\nUpdate the WordPress Advanced Custom Fields plugin to the latest available version (at least 5.12.3).","date":"2022-08-01"},{"id":"3fde5336-552c-4861-8b4d-89a16735c0e2","name":"Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload","link":"https:\/\/wpscan.com\/vulnerability\/3fde5336-552c-4861-8b4d-89a16735c0e2","description":"The plugin allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.\r\n\r\nBy default WordPress does not allow uploading of .php files so this vulnerability is not easily wormable, but there are many other file types that can be uploaded that can be then used with another exploit to execute code or used in a phishing attack to get a user to download and execute a resource from a "trusted" site.","date":null},{"id":"3de6f8e30d3de15171ba35031ec707cc62850ae9","name":"Advanced Custom Fields <= 5.12.2 - File Upload","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/advanced-custom-fields\/advanced-custom-fields-5122-file-upload","description":"The Advanced Custom Fields plugin for WordPress has a file upload vulnerability in versions up to, and including, 5.12.2. This allows users without the upload_files capability, such as contributors, or unauthenticated users in cases where a frontend form is added to the site, to upload allowed file types. The upload is handled by WordPress so file type and extension checks still occur, though this could potentially be used by high-privileged users in certain locked-down configurations to bypass other security mechanisms and upload dangerous file types.","date":"2022-07-14"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"h","i":"h","a":"h","score":"8.8","severity":"h","exploitable":"2.8","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","score":"8.8","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"2.8","impact":"5.9"},"cwe":[{"cwe":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type","description":"The product allows the upload or transfer of dangerous file types that are automatically processed within its environment."}]}},{"uuid":"ef4827fc1dd410fb7d8920a47414bacc8b17ce9c8b814f7e8cc54f8ed70287aa","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 5.7.12","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.7.12","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"14d0223a-4aca-4069-82f2-ba22e354daad","name":"Advanced Custom Fields <= 5.7.10 - Unserialize of user input","link":"https:\/\/wpscan.com\/vulnerability\/14d0223a-4aca-4069-82f2-ba22e354daad","description":"Multiple maybe_unserialize calls result with unserialize of user input. Low priviledged users as contributors, but in many cases visitors too","date":null}],"impact":[]},{"uuid":"9eeaf56de96fc8a5e4b617ca440fc72d901874aff90a60d8bb67d4192fa8e069","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 3.5.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.5.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"d132d93b-509c-490d-8001-87147ed28c5e","name":"Advanced Custom Fields <= 3.5.1 - Remote File Inclusion","link":"https:\/\/wpscan.com\/vulnerability\/d132d93b-509c-490d-8001-87147ed28c5e","description":"The Advanced Custom Fields WordPress plugin was affected by a Remote File Inclusion security vulnerability.","date":null}],"impact":[]},{"uuid":"d1b5934e22fe18fc3f1f17e188efc71d7a1e957e2c5a23b125bc571266357f8e","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] >= 3.1.1 - <= 6.0.2","description":null,"operator":{"min_version":"3.1.1","min_operator":"ge","max_version":"6.0.2","max_operator":"le","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2022-40696","name":"CVE-2022-40696","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-40696","description":"[en] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.","date":"2024-01-08"},{"id":"42c22fc014a2c54cb5adb8ec4fdedf0663b19d8a","name":"WordPress Advanced Custom Fields plugin 3.1.1 - 6.0.2 - Custom Field Value Exposure vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-3-1-1-6-0-2-custom-field-value-exposure","description":"Custom Field Value Exposure Through Parsed Shortcode from User Input vulnerability discovered by Juan Hoffmann in WordPress Advanced Custom Fields plugin (versions 3.1.1 - 6.0.2).\nUpdate the WordPress Advanced Custom Fields plugin to the latest available version (at least 6.0.3).","date":"2022-10-18"},{"id":"72bbd39232f52ffdd838d41e6a5f6e8cb20cda39","name":"Advanced Custom Fields <= 6.0.2 - Authenticated (Contributor+) Information Disclosure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/advanced-custom-fields\/advanced-custom-fields-602-authenticated-contributor-information-disclosure","description":"The Advanced Custom Fields plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 6.0.2. While the ACF shortcode ensures that the ACF data being accessed is valid data that has been entered into ACF fields, it may be possible with certain site configurations, that contributor-level users may extract sensitive user or configuration data.","date":"2022-10-18"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"h","pr":"n","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"3.7","severity":"l","exploitable":"3.9","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"3.7","severity":"low","av":"network","ac":"high","pr":"none","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"3.9","impact":"3.6"},"cwe":[{"cwe":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"51212ef947339bbaa84a6cc9179453dfac8a622167104628f9d8580b6cec634b","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 5.7.12","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.7.12","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"dd56082db9466588ba9cb80e5213ed59d272a1bc","name":"Advanced Custom Fields <= 5.7.11 - PHP Object Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/advanced-custom-fields\/advanced-custom-fields-5711-php-object-injection","description":"Advanced Custom Fields before 5.7.12 fails to sanitize user-supplied input before passing it to the unserialize() function. This allows low-level authenticated users to call PHP Objects and possibly achieve remote code execution if a usable gadget is present in a plugin or theme installed on the same site as the vulnerable plugin.","date":"2019-02-15"}],"impact":[]},{"uuid":"cf7eadd55a665a3fc0b1addd25f8f7591a7d70ccf94f24fc700c96a6d8624ccb","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 3.5.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.5.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"27c36a1a1ba62a5d7b70c0949bda228fd485e4a5","name":"Advanced Custom Fields <= 3.5.1 - Remote Code Execution via Remote File Inclusion","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/advanced-custom-fields\/advanced-custom-fields-351-remote-code-execution-via-remote-file-inclusion","description":"Advanced Custom Fields up to 3.5.1 is vulnerable to Remote Code Execution. The vulnerability allows for remote file inclusion and remote code execution via the export.php script. This exploit only works when the php option allow_url_include is set to On (Default Off).","date":"2013-01-03"},{"id":"CVE-2012-10025","name":"CVE-2012-10025","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2012-10025","description":"[en] The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core\/actions\/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server\u2019s context, allowing full compromise of the host.","date":"2025-08-05"},{"id":"EUVD-2012-6571","name":"EUVD-2012-6571","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2012-6571","description":"The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core\/actions\/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server\u2019s context, allowing full compromise of the host.","date":"2025-08-05"}],"impact":{"cwe":[{"cwe":"CWE-98","name":"Improper Control of Filename for Include\/Require Statement in PHP Program ('PHP Remote File Inclusion')","description":"The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in \"require,\" \"include,\" or similar functions."}],"ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"total","kev":false,"kev_date":null},"cvss4":{"version":"4.0","vector":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/VI:H\/VA:H\/SC:H\/SI:H\/SA:H","score":"10.0","severity":"critical","av":"network","ac":"low","at":"none","pr":"none","ui":"none","vc":"high","vi":"high","va":"high","sc":"high","si":"high","sa":"high"},"epss":"0.003"}},{"uuid":"1ce4c9d3dd245b303e783575a0e705e21554db7dfe700d9568b7ec1d91080d1b","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 5.12.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.12.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"302fd74e5ed6ab445e1a337bbfa1973730ea4943","name":"WordPress Advanced Custom Fields Plugin <= 6.0.7 is vulnerable to PHP Object Injection","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-6-0-7-authenticated-contributor-php-object-injection-vulnerability","description":"Update the WordPress Advanced Custom Fields plugin to the latest available version (at least 5.12.5 or 6.1.0).\nUnknown discovered and reported this PHP Object Injection vulnerability in WordPress Advanced Custom Fields Plugin. This could allow a malicious actor to execute code injection, SQL injection, path traversal, denial of service, and more if a proper POP chain is present. This vulnerability has been fixed in version 6.1.0.","date":"2023-04-04"}],"impact":[]},{"uuid":"94ba7c5c4a3b72be0fa606471319bef9af283c7521f70ba53154bcba05319cfa","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 5.12.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.12.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-1196","name":"CVE-2023-1196","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-1196","description":"[en] The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.","date":"2023-05-02"},{"id":"6d8fbcb9889375082cb43ea5294684770fd13b9b","name":"WordPress Advanced Custom Fields PRO Plugin < 6.1.0 is vulnerable to PHP Object Injection","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields-pro\/vulnerability\/wordpress-advanced-custom-fields-pro-plugin-6-1-0-contributor-php-object-injection-vulnerability","description":"Update the WordPress Advanced Custom Fields Pro plugin to the latest available version (at least 6.1.0).\nNguyen Huu Do discovered and reported this PHP Object Injection vulnerability in WordPress Advanced Custom Fields PRO Plugin. This could allow a malicious actor to execute code injection, SQL injection, path traversal, denial of service, and more if a proper POP chain is present. This vulnerability has been fixed in version 6.1.0.","date":"2023-05-02"},{"id":"abc11923dc7fe4b9fe1d1ab9e8080478c8879e37","name":"WordPress Advanced Custom Fields Plugin < 5.12.5 is vulnerable to PHP Object Injection","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-6-1-0-contributor-php-object-injection-vulnerability","description":"Update the WordPress Advanced Custom Fields plugin to the latest available version (at least 5.12.5).\nNguyen Huu Do discovered and reported this PHP Object Injection vulnerability in WordPress Advanced Custom Fields Plugin. This could allow a malicious actor to execute code injection, SQL injection, path traversal, denial of service, and more if a proper POP chain is present. This vulnerability has been fixed in version 5.12.5.","date":"2023-05-02"},{"id":"9f1ce97ed012a7301d04026383675818b4a61ee3","name":"Advanced Custom Fields <= 6.0.7 - Authenticated (Contributor+) PHP Object Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/advanced-custom-fields\/advanced-custom-fields-607-authenticated-contributor-php-object-injection","description":"The Advanced Custom Fields plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.0.7 via deserialization of untrusted input in custom field values. This makes it possible for authenticated attackers, with contributor-level permissions, and above to inject a PHP Object. No POP chain appears to be present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.","date":"2023-04-03"},{"id":"8e5ec88e-0e66-44e4-bbf2-74155d849ede","name":"Advanced Custom Fields < 6.1.0 - Contributor+ PHP Object Injection","link":"https:\/\/wpscan.com\/vulnerability\/8e5ec88e-0e66-44e4-bbf2-74155d849ede","description":"The plugin unserializes user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.","date":null},{"id":"cf376ca2-92f6-44ff-929a-ace809460a33","name":"Advanced Custom Fields < 5.12.5 - Contributor+ PHP Object Injection","link":"https:\/\/wpscan.com\/vulnerability\/cf376ca2-92f6-44ff-929a-ace809460a33","description":"The plugin unserializes user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"8.8","severity":"h","exploitable":"2.8","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"8.8","severity":"high","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"2.8","impact":"5.9"},"cwe":[{"cwe":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","kev":false,"kev_date":null}}},{"uuid":"91d71955e0e9ecc8c6caef50a38a7ef3b1f0a28ba44142e4b9043a38db5d8ca3","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 6.1.6","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.1.6","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"05c34ed28a78f0b103cc5f49747bd26e99ccc809","name":"Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5 & 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status'","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/advanced-custom-fields\/advanced-custom-fields-615-reflected-cross-site-scripting-via-post-status","description":"The Advanced Custom Fields (free & PRO) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_status' parameter in versions 5.8.10 to 5.12.5 and versions 6.0.0 to 6.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2023-05-04"},{"id":"CVE-2023-30777","name":"CVE-2023-30777","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-30777","description":"[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <=\u00a06.1.5 versions.","date":"2023-05-10"},{"id":"95ded80f-a47b-411e-bd17-050439bf565f","name":"Advanced Custom Fields < 6.1.6 - Reflected XSS","link":"https:\/\/wpscan.com\/vulnerability\/95ded80f-a47b-411e-bd17-050439bf565f","description":"The plugins do not escape the post_status parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"7.1","severity":"h","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"7.1","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"644d89382edbaef94212f7e90932b1b03e99ef75a5d3507acfa0f2b61cac7883","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 6.1.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.1.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"e830edb76769949628f43de0e8d6786fc1bac799","name":"WordPress Advanced Custom Fields Plugin <= 6.1.7 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-6-1-7-authenticated-stored-cross-site-scripting-vulnerability","description":"Update the WordPress Advanced Custom Fields plugin to the latest available version (at least 6.1.8).\nSatoo Nakano, Ryotaro Imamura discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Advanced Custom Fields Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 6.1.8.","date":"2023-08-03"}],"impact":[]},{"uuid":"d2abda6613826bdd92044d9f0233526de2d1d52006fbae1c11ae408d1357b15b","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] >= 6.1.0 - <= 6.1.7","description":null,"operator":{"min_version":"6.1.0","min_operator":"ge","max_version":"6.1.7","max_operator":"le","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-40068","name":"CVE-2023-40068","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-40068","description":"[en] Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.","date":"2023-08-21"},{"id":"JVNDB-2023-000084","name":"WordPress Plugin \"Advanced Custom Fields\" vulnerable to cross-site scripting","link":"http:\/\/jvndb.jvn.jp\/jvndb\/JVNDB-2023-000084","description":"WordPress Plugin \"Advanced Custom Fields\" provided by WP Engine contains a cross-site scripting vulnerability (CWE-79). Ryotaro Imamura of SB Technology Corp. and Satoo Nakano reported this vulnerability to IPA. JPCERT\/CC coordinated with the developer under Information Security Early Warning Partnership.","date":"2023-08-21"},{"id":"edd969fd3a4bffc7e32a2663629ce6d0d72c8a17","name":"Advanced Custom Fields 6.1 - 6.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/advanced-custom-fields\/advanced-custom-fields-617-authenticated-administrator-stored-cross-site-scripting","description":"The Advanced Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ACF post type and taxonomy labels in versions 6.1 to 6.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2023-08-03"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"5.4","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"60b14f809e5ca6841029dcec19d8c6ddfc16cdd4633fc86aeb4fd54aa90ff298","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 6.2.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.2.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-6701","name":"CVE-2023-6701","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-6701","description":"[en] The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-02-05"},{"id":"8fd994a34172cc5cb43ca9ea6b9abd808c916c27","name":"Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/advanced-custom-fields-624-authenticated-contributor-stored-cross-site-scripting-via-custom-field","description":"The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-01-17"},{"id":"9a536e07-6e99-45c1-9233-f7cee5c29ea4","name":"Advanced Custom Fields < 6.2.5 - Contributor+ Stored Cross-Site Scripting via Custom Field","link":"https:\/\/wpscan.com\/vulnerability\/9a536e07-6e99-45c1-9233-f7cee5c29ea4","description":"The plugin is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"5.4","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"364a4a1f8e180d5de2a2bda7507bbed226ee1c5558f0ef03c876968715725387","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 6.2.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.2.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"32da9e2517b2f664d6d8ab91a4133b45368edd1a","name":"WordPress Advanced Custom Fields Plugin < 6.2.5 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-6-2-5-contributor-stored-cross-site-scripting-vulnerability","description":"Update the WordPress Advanced Custom Fields plugin to the latest available version (at least 6.2.5).\nFrancesco Carlucci discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Advanced Custom Fields Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 6.2.5.\nHave additional information or questions about this entry? Get in touch.","date":"2024-01-16"}],"impact":[]},{"uuid":"2658843a88fdeedf868d8d3d85b086dbb85815b9429f4d6cc114c2c91b5bd0e2","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 6.3.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.3.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-4565","name":"CVE-2024-4565","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-4565","description":"[en] The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access","date":"2024-06-20"},{"id":"371ebd77b1fe55d11715dfc139f8518a82bc0175","name":"WordPress Advanced Custom Fields Plugin < 6.3 is vulnerable to Sensitive Data Exposure","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-6-3-auth-custom-field-access","description":"
WordPress Advanced Custom Fields Plugin < 6.3 is vulnerable to Sensitive Data Exposure<\/p>
Software: Advanced Custom Fields<\/p>
Link: https:\/\/wordpress.org\/plugins\/advanced-custom-fields\/#developers<\/p>
Affected Version < 6.3<\/p>
Fixed in version 6.3 <\/p>","date":"2024-06-03"},{"id":"7c3cc2eb3c3b3d187213f169078c8f52dbe2e73d","name":"WordPress Advanced Custom Fields PRO Plugin < 6.3 is vulnerable to Sensitive Data Exposure","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields-pro\/vulnerability\/wordpress-advanced-custom-fields-pro-plugin-6-3-auth-custom-field-access-vulnerability","description":"
WordPress Advanced Custom Fields PRO Plugin < 6.3 is vulnerable to Sensitive Data Exposure<\/p>
Affected Version < 6.3<\/p>
Fixed in version 6.3 <\/p>","date":"2024-06-03"},{"id":"dbfc7192bc51d481865183530b8b498062008687","name":"Advanced Custom Fields <= 6.2.10 - Authenticated (Contributor+) Arbitrary Custom Field Access","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/advanced-custom-fields-6210-authenticated-contributor-arbitrary-custom-field-access","description":"The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to arbitrary custom field access in all versions up to, and including, 6.2.10. This is due to the plugin not properly restricting what post meta can be displayed through the plugin's shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve potentially sensitive information from custom fields.","date":"2024-05-30"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:H\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"n","i":"h","a":"n","score":"6.5","severity":"m","exploitable":"2.8","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:H\/A:N","score":"6.5","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"high","a":"none","exploitable":"2.8","impact":"3.6"},"cwe":[{"cwe":"CWE-284","name":"Improper Access Control","description":"The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor."}],"ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"dac637def5a8cfb0d284bfadfd539505cedc1259eb4571ff8252ab91aa28c6db","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 6.3.6","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.3.6","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-45429","name":"CVE-2024-45429","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-45429","description":"[en] Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker's.","date":"2024-09-04"},{"id":"JVNDB-2024-000093","name":"WordPress Plugin \"Advanced Custom Fields\" vulnerable to cross-site scripting","link":"http:\/\/jvndb.jvn.jp\/jvndb\/JVNDB-2024-000093","description":"The field labels in WordPress Plugin \"Advanced Custom Fields\" provided by WP Engine contains a cross-site scripting vulnerability (CWE-79). Ryo Sotoyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT\/CC coordinated with the developer under Information Security Early Warning Partnership.","date":"2024-09-04"},{"id":"be4d36ad2a7bdb42e3b5eb6a069160a07d678d7c","name":"Advanced Custom Fields <= 6.3.5 - Authenticated Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/advanced-custom-fields-635-authenticated-stored-cross-site-scripting","description":"The Advanced Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via field groups in all versions up to, and including, 6.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with the 'capability' setting privilege, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-09-04"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"91ef0fc68e17507292e0204cb5d64460371d8693bf32fe46ca971ef18b839e40","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 6.3.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.3.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"7e825feade777e676c0565a26ea311ec75ec9cdc","name":"Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/advanced-custom-fields\/advanced-custom-fields-637-authenticated-admin-limited-arbitrary-function-call","description":"The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to limited arbitrary function calls via the 'register_meta_box_cb' and 'meta_box_cb' parameters in all versions up to, and including, 6.3.8 (excluding 6.3.6.2) due to insufficient input validation on those parameters. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary functions, like WordPress functions, in custom post types that will execute whenever a user accesses the injected post type. This can be leveraged to trick other users like administrators accessing posts into performing unauthorized actions through functions, and is not a very serious risk for the vast majority of site owners. Please follow the reference listed in this vulnerability record for instructions on how to update to the latest version of ACF that patches this issue and ensures accessibility to updates moving forward. Please note this issue was partially patched in 6.3.8 and 6.3.6.1 - 6.3.6.2, however, was hardened further in 6.3.6.3 and 6.3.9.","date":"2024-10-07"},{"id":"CVE-2024-9529","name":"CVE-2024-9529","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-9529","description":"[en] The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.","date":"2024-11-15"},{"id":"9f1fe2cca7d5eea88ddc61273abd013a4f91eb66","name":"WordPress Advanced Custom Fields Plugin <= 6.3.7 is vulnerable to Arbitrary Code Execution","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-6-3-7-cross-site-request-forgery-vulnerability","description":"
WordPress Advanced Custom Fields Plugin <= 6.3.7 is vulnerable to Arbitrary Code Execution<\/p>
Software: Advanced Custom Fields<\/p>
Link: https:\/\/wordpress.org\/plugins\/advanced-custom-fields\/#developers<\/p>
Affected Version <= 6.3.7<\/p>
Fixed in version 6.3.8 <\/p>","date":"2024-10-07"},{"id":"2870790d36b1bfde8f945f8d9e6eccd9a71acaf7","name":"WordPress Advanced Custom Fields PRO Plugin <= 6.3.7 is vulnerable to Arbitrary Code Execution","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields-pro\/vulnerability\/wordpress-advanced-custom-fields-pro-plugin-6-3-7-administrator-limited-arbitrary-function-call-vulnerability","description":"
WordPress Advanced Custom Fields PRO Plugin <= 6.3.7 is vulnerable to Arbitrary Code Execution<\/p>
Affected Version <= 6.3.7<\/p>
Fixed in version 6.3.8 <\/p>","date":"2024-10-09"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"h","ui":"n","s":"c","c":"l","i":"l","a":"l","score":"6.6","severity":"m","exploitable":"2.3","impact":"3.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:L","score":"6.6","severity":"medium","av":"network","ac":"low","pr":"high","ui":"none","s":"changed","c":"low","i":"low","a":"low","exploitable":"2.3","impact":"3.7"},"cwe":[{"cwe":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","description":"The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"7a87bba49995afdd8d4d9dee97193a6679e2d74d1043ce7d67d3a3b77e0ba4d1","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 6.3.9","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.3.9","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-49593","name":"CVE-2024-49593","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-49593","description":"[en] In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the free version of ACF, then you can follow the process shown at the advancedcustomfields.com blog URL within the References section below.","date":"2024-10-17"},{"id":"6872ad989a01a94ce51c39f36553acc5205de23b","name":"Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/advanced-custom-fields-638-secure-custom-fields-6362-authenticated-admin-stored-cross-site-scripting","description":"The Advanced Custom Fields & Secure Custom Fields plugins for WordPress are vulnerable to Stored Cross-Site Scripting via ACF field labels in all versions up to, and including, 6.3.8 & 6.3.6.2 respectively due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Please follow the reference listed in this vulnerability record for instructions on how to update to the latest version of ACF that patches this issue and ensures accessibility to updates moving forward. Special note: only the minified files in Secure Custom Fields have been patched meaning the source build files are still vulnerable.","date":"2024-10-15"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"5.3","severity":"m","exploitable":"3.9","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"3.9","impact":"1.4"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"b05f2a6b392461033404e7dd9b7a47fec9f813a936545a90ca328581773f88ac","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 6.3.9","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.3.9","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"a15e2dee48f77e47a7b375c4632e776f9d1d1d00","name":"WordPress Advanced Custom Fields Plugin <= 6.3.6.2 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-6-3-8-authenticated-admin-stored-cross-site-scripting-vulnerability","description":"
WordPress Advanced Custom Fields Plugin <= 6.3.6.2 is vulnerable to Cross Site Scripting (XSS)<\/p>
Software: Advanced Custom Fields<\/p>
Link: https:\/\/wordpress.org\/plugins\/advanced-custom-fields\/#developers<\/p>
Affected Version <= 6.3.6.2<\/p>
Fixed in version 6.3.6.3 <\/p>","date":"2024-10-16"}],"impact":[]},{"uuid":"3f29e4c03b12b23de620109f4a6b329a122d9dbbbecffcf8f3ecd937d1da6e96","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 3.5.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.5.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"dc344e682e4204e77416281f1a2d91b76e4c6302","name":"WordPress Advanced Custom Fields Plugin <= 3.5.1 is vulnerable to Remote Code Execution (RCE)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/advanced-custom-fields\/vulnerability\/wordpress-advanced-custom-fields-plugin-3-5-1-remote-code-execution-via-remote-file-inclusion-vulnerability","description":"
WordPress Advanced Custom Fields Plugin <= 3.5.1 is vulnerable to Remote Code Execution (RCE)<\/p>
Software: Advanced Custom Fields<\/p>
Fixed in version 3.5.2 <\/p>
Affected Version <= 3.5.1<\/p>","date":"2025-08-05"}],"impact":[]},{"uuid":"2b0d565bd6a05ce8dd34ca3cadb921600f5aa856243aa20aa125da58bfc5586f","name":"Advanced Custom Fields (ACF\u00ae) [advanced-custom-fields] < 6.4.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.4.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-54940","name":"CVE-2025-54940","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-54940","description":"[en] An HTML injection vulnerability exists in WordPress plugin \"Advanced Custom Fields\" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered.","date":"2025-08-08"},{"id":"f35d76177f4cdf248d71822adda3db3e63c000bb","name":"Advanced Custom Fields <= 6.4.2. - HTML Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/advanced-custom-fields\/advanced-custom-fields-642-html-injection","description":"The Advanced Custom Fields (ACF\u00ae) plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 6.4.2. This is due to the plugin nor properly neutralizing unsafe HTML. This makes it possible for authenticated attackers, with administrator-level access and above, to inject potentially malicious HTML.","date":"2025-08-08"},{"id":"EUVD-2025-23979","name":"EUVD-2025-23979","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-23979","description":"An HTML injection vulnerability exists in WordPress plugin \"Advanced Custom Fields\" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered.","date":"2025-08-08"},{"id":"JVNDB-2025-000058","name":"WordPress plugin \"Advanced Custom Fields\" vulnerable to HTML injection","link":"http:\/\/jvndb.jvn.jp\/jvndb\/JVNDB-2025-000058","description":"Advanced Custom Fields provided by WPEngine, Inc. contains the following vulnerability.