| CVE-2026-4812 | Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters | wpengine | Advanced Custom Fields (ACF®) | Medium | 5.3 | 2026-04-15 01:25:18 | Deep Dive |
| CVE-2026-21627 | Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla | tassos.gr | Novarain/Tassos Framework (plg_system_nrframework) | - | - | 2026-02-20 14:22:15 | Deep Dive |
| CVE-2025-14983 | Advanced Custom Fields: Font Awesome <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | mattkeys | Advanced Custom Fields: Font Awesome Field | Medium | 6.4 | 2026-02-19 04:36:23 | Deep Dive |
| CVE-2025-14533 | Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action | hwk-fr | Advanced Custom Fields: Extended | Critical | 9.8 | 2026-01-20 09:25:01 | Deep Dive |
| CVE-2025-13486 | Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form | hwk-fr | Advanced Custom Fields: Extended | Critical | 9.8 | 2025-12-03 06:47:47 | Deep Dive |
| CVE-2025-60208 | WordPress Advanced Custom Fields : CPT Options Pages plugin <= 2.0.9 - Cross Site Request Forgery (CSRF) vulnerability | Tusko Trush | Advanced Custom Fields : CPT Options Pages | - | - | 2025-10-22 14:32:43 | Deep Dive |
| CVE-2025-10380 | Advanced Views – Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI | wplakeorg | Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… | High | 8.8 | 2025-09-23 03:34:34 | Deep Dive |
| CVE-2025-54940 | WordPress plugin Advanced Custom Fields 代码注入漏洞 | WPEngine, Inc. | Advanced Custom Fields | 低危 | - | 2025-08-08 04:34:02 | Deep Dive |
| CVE-2012-10025 | WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File Inclusion | Advanced Custom Fields | WordPress Plugin | - | - | 2025-08-05 20:06:01 | Deep Dive |
| CVE-2025-26746 | WordPress Advanced Custom Fields: Link Picker Field plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability | caalami | Advanced Custom Fields: Link Picker Field | High | 7.1 | 2025-04-15 21:53:10 | Deep Dive |
| CVE-2024-37251 | WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Cross-Site Request Forgery (CSRF) vulnerability | WPENGINE, INC. | Advanced Custom Fields PRO | Medium | 4.3 | 2024-12-16 15:03:39 | Deep Dive |
| CVE-2024-9529 | Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution | Unknown | Secure Custom Fields | - | - | 2024-11-15 06:00:08 | Deep Dive |
| CVE-2024-37250 | WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Subscriber+ Broken Access Control vulnerability | WPEngine Inc. | Advanced Custom Fields PRO | Medium | 5.4 | 2024-11-01 14:18:41 | Deep Dive |
| CVE-2024-37249 | WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Contributor+ Broken Access Control vulnerability | WPEngine Inc. | Advanced Custom Fields PRO | Medium | 4.3 | 2024-11-01 14:18:40 | Deep Dive |
| CVE-2022-4974 | Freemius SDK <= 2.4.2 - Missing Authorization Checks | dashlabsltd | YASR – Yet Another Star Rating Plugin for WordPress | Medium | 6.3 | 2024-10-16 06:43:30 | Deep Dive |
| CVE-2024-45429 | WordPress plugin Advanced Custom Fields和WordPress plugin Advanced Custom Fields Pro 安全漏洞 | WP Engine | Advanced Custom Fields | - | - | 2024-09-04 23:07:58 | Deep Dive |
| CVE-2024-4565 | Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access | Unknown | Advanced Custom Fields (ACF) | - | - | 2024-06-20 06:00:03 | Deep Dive |
| CVE-2024-34762 | Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Local File Inclusion vulnerability | WPENGINE INC | Advanced Custom Fields PRO | Critical | 9.9 | 2024-06-10 15:38:40 | Deep Dive |
| CVE-2024-34761 | Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Arbitrary Function Execution vulnerability | WPENGINE INC | Advanced Custom Fields PRO | High | 8.5 | 2024-06-10 15:34:32 | Deep Dive |
| CVE-2023-6701 | Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field | wpengine | Advanced Custom Fields (ACF®) | Medium | 6.4 | 2024-02-05 21:22:04 | Deep Dive |