Skip to content
Noroxi

Advanced Custom Fields: Extended

acf-extended · plugin

Known security vulnerabilities for Advanced Custom Fields: Extended. Find out in seconds which version runs on your site with WP Lens.

6 known vulnerabilities

3 critical · 2 with public exploit code · latest Aug 28, 2026

Vulnerabilities

  • CVE-2026-8809

    Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter

    Critical 9.8

  • CVE-2025-14533

    Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action

    Critical 9.8

  • CVE-2025-13486

    Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form

    Critical 9.8

  • CVE-2025-15463

    Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution

    Medium 6.5

  • CVE-2023-5292

    Advanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    Medium 5.4

  • CVE-2026-81284

    WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

    Medium 4.3

← Back to directory