Skip to content
Noroxi

Advanced Custom Fields

advanced-custom-fields · plugin

Known security vulnerabilities for Advanced Custom Fields. Find out in seconds which version runs on your site with WP Lens.

15 known vulnerabilities

1 critical · 2 with public exploit code · latest May 31, 2026

Vulnerabilities

  • CVE-2012-10025

    WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File Inclusion

    Critical 10.0

  • CVE-2022-40696

    WordPress Advanced Custom Fields Plugin 3.1.1-6.0.2 is vulnerable to Sensitive Data Exposure

    High 7.5

  • CVE-2021-20865

    Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerab

    High 7.5

  • CVE-2022-23183

    Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12

    Medium 6.5

  • CVE-2021-20867

    Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerab

    Medium 6.5

  • CVE-2021-20866

    Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerab

    Medium 6.5

  • CVE-2024-45429

    Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5

    Medium 6.1

  • CVE-2023-30777

    WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2020-36172

    The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading t

    Medium 6.1

  • CVE-2023-6701

    Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field

    Medium 5.4

  • CVE-2023-40068

    Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7

    Medium 5.4

  • CVE-2018-20986

    The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.

    Medium 5.4

  • CVE-2026-8382

    Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters

    Medium 5.3

  • CVE-2026-4812

    Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters

    Medium 5.3

  • CVE-2024-49593

    In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor t

    Medium 5.3

← Back to directory