Skip to content
Noroxi

advancedcustomfields records

17 published records for vendor advancedcustomfields.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
29.4%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 21
  3. 22
  4. 23
  5. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

17 records
  • CVE-2015-9479
    40Plan

    The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery

    CriticalCVSS 9.8No exploitEPSS 3%

    advancedcustomfields · acf fronted displayOct 10, 2019

  • CVE-2023-30777
    36Monitor

    WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 39%

    advancedcustomfields · advanced custom fieldsMay 10, 2023

  • CVE-2022-2594
    35Monitor

    Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload

    HighCVSS 8.8No exploitEPSS 2%

    advancedcustomfields · advanced custom fieldsAug 22, 2022

  • CVE-2023-1196
    35Monitor

    Advanced Custom Fields - Contributor+ PHP Object Injection

    HighCVSS 8.8No exploitEPSS 1%

    advancedcustomfields · advanced custom fieldsMay 2, 2023

  • CVE-2024-34761
    34Monitor

    Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Arbitrary Function Execution vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    wpengine inc · advanced custom fields proJun 10, 2024

  • CVE-2021-20865
    31Monitor

    Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerab

    HighCVSS 7.5No exploitEPSS 2%

    advancedcustomfields · advanced custom fieldsDec 13, 2021

  • CVE-2022-40696
    30Monitor

    WordPress Advanced Custom Fields Plugin 3.1.1-6.0.2 is vulnerable to Sensitive Data Exposure

    HighCVSS 7.5No exploitEPSS 1%

    advancedcustomfields · advanced custom fieldsJan 8, 2024

  • CVE-2021-20866
    26Monitor

    Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerab

    MediumCVSS 6.5No exploitEPSS 2%

    advancedcustomfields · advanced custom fieldsDec 13, 2021

  • CVE-2022-23183
    26Monitor

    Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12

    MediumCVSS 6.5No exploitEPSS 1%

    advancedcustomfields · advanced custom fieldsMar 31, 2022

  • CVE-2021-20867
    26Monitor

    Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerab

    MediumCVSS 6.5No exploitEPSS 1%

    advancedcustomfields · advanced custom fieldsDec 13, 2021

  • CVE-2024-9529
    26Monitor

    Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution

    MediumCVSS 6.6No exploitEPSS 0%

    advancedcustomfields · advanced custom fieldsNov 15, 2024

  • CVE-2024-4565
    26Monitor

    Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access

    MediumCVSS 6.5No exploitEPSS 0%

    advancedcustomfields · advanced custom fieldsJun 20, 2024

  • CVE-2021-24241
    24Monitor

    Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)

    MediumCVSS 6.1No exploitEPSS 1%

    advancedcustomfields · advanced custom fieldsApr 22, 2021

  • CVE-2020-36172
    24Monitor

    The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading t

    MediumCVSS 6.1No exploitEPSS 1%

    advancedcustomfields · advanced custom fieldsJan 6, 2021

  • CVE-2023-40068
    22Monitor

    Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7

    MediumCVSS 5.4No exploitEPSS 2%

    advancedcustomfields · advanced custom fieldsAug 21, 2023

  • CVE-2018-20986
    21Monitor

    The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.

    MediumCVSS 5.4No exploitEPSS 1%

    advancedcustomfields · advanced custom fieldsAug 22, 2019

  • CVE-2023-6701
    21Monitor

    Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field

    MediumCVSS 5.4No exploitEPSS 1%

    advancedcustomfields · advanced custom fieldsFeb 5, 2024