CVE-2025-13486

批量利用 CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - 在 prepareform 中未经认证的远程代码执行 ⚠️ 漏洞详情 WordPress 的 Advanced Custom Fields: Extended 插件在 0.9.0.5 至 0.9.1.1 版本中存在远程代码执行漏洞，问题出在 prepareform 函数。该函数接受用户输入并将其传递给 calluserfuncarray，因而容易受到攻击。这使得未经认证的攻击者能够在服务器上执行任意代码，进而可用于注入后门或创建新的管理员用户账户...

Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution

Advanced Custom Fields: Extended WordPress plugin 0.9.0.5 through 0.9.1.1 contains a remote code execution caused by unsafe use of calluserfuncarray in prepareform function, letting unauthenticated attackers execute arbitrary code remotely. id: CVE-2025-13486 info: name: Advanced Custom Fields...

CVE-2023-30777

CVE-2023-30777 用于 Advanced Custom Fields WordPress 插件中反射型 XSS 漏洞的概念验证（PoC）URL 生成器。 PoC 生成者： Alucard0x1 漏洞致谢： https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites/...

CVE-2025-13486

🔴 CVE-2025-13486 - Advanced Custom Fields Extended ACFE WordPress插件利用工具 📋 概述 CVE-2025-13486 的概念验证利用工具，该漏洞是 Advanced Custom Fields: Extended ACFE WordPress 插件中的一个严重漏洞，允许远程代码执行，进而实现权限提升。 🎯 漏洞详情 方面| 详情 ---|--- CVE ID| CVE-2025-13486 插件| Advanced Custom Fields: Extended ACFE 类型| 远程代码执行 → 权限提升 风险等级| 严...

CVE-2026-12526

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

EUVD-2026-69846

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

CVE-2026-12526 Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

CVE-2026-12526

Advanced Custom Fields: Extended WordPress plugin versions before 0.9.2.7 contain an authorization bypass in the update-user action of its front-end Forms module. The plugin only enforces a capability check when the submitted role is administrator or super_admin , failing to verify that the reque...

Vulnerability of the prepare_form() function in the acfe_module_form_front.render plugin: This vulnerability allows a hacker to execute arbitrary code.

Vulnerability of the prepareform function in the acfemoduleformfront.render method of the Advanced Custom Fields plugin: This vulnerability is related to improper handling of code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2026-66678

Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field = 6.1.1 versions...

EUVD-2026-53892

Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field = 6.1.1 versions...

CVE-2026-66678

Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field = 6.1.1 versions...

CVE-2026-66678 WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.1 - Broken Access Control vulnerability

Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field = 6.1.1 versions...

CVE-2026-66678

CVE-2026-66678 concerns a Broken Access Control issue in the WordPress plugin Advanced Custom Fields: Font Awesome Field , affecting versions up to and including 6.1.1 . The connected sources consistently describe the vulnerability class and affected plugin/version but do not provide technical de...

WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Advanced Custom Fields: Font Awesome Field versions = 6.1.2...

CVE-2026-15262

The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of...

CVE-2026-15262

The CVE concerns the WordPress plugin Admin Columns for ACF Fields (vulnerable through 0.3.2). The issue is a stored XSS in the admin post-list screen: ACF field values are not escaped before being output in WordPress admin list-table columns, enabling users with contributor-level access or highe...

CVE-2026-15262 Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column

The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of...

CVE-2026-1667

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-12428 Blocks for ACF Fields <= 1.6.2 - Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'id' Parameter

The Blocks for ACF Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getallvalues function in the /wp-json/acf-field-blocks/v1/values REST endpoint in versions up to, and including, 1.6.2. The permissioncallback only verifies the...