CVE-2026-124755

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Justin Kruit Advanced Custom Fields: Font Awesome Field advanced-custom-fields-font-awesome allows Stored XSS.This issue affects Advanced Custom Fields: Font Awesome Field: from n/a through 6.1.4...

CVE-2025-13486

Mass Exploit CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepareform ⚠️ Vulnerability Details The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via th...

CVE-2023-30777

CVE-2023-30777 Proof of Concept PoC URL generator for a reflected XSS vulnerability in the Advanced Custom Fields WordPress plugin. PoC Generate by : Alucard0x1 Credit of Exploit : https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites/...

CVE-2025-13486

🔴 CVE-2025-13486 - Advanced Custom Fields Extended ACFE WordPress Plugin Exploit 📋 Overview Proof-of-concept exploit for CVE-2025-13486 , a critical vulnerability in the Advanced Custom Fields: Extended ACFE WordPress plugin that allows Remote Code Execution leading to Privilege Escalation. 🎯...

WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Gabriel Igor in WordPress Plugin Advanced Custom Fields: Font Awesome Field versions = 6.1.4...

CVE-2026-97191

The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators...

CVE-2026-97189

The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access Contributor and above to disclose the titles and non-public statuses of other users'...

CVE-2026-97190

The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own...

CVE-2026-97189 Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields

The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access Contributor and above to disclose the titles and non-public statuses of other users'...

WordPress Advanced Custom Fields (ACF®) plugin 6.2.0-6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects vulnerability

Contributor+ Relationship Field Update on Arbitrary Objects vulnerability discovered by vuxvinh in WordPress Plugin Advanced Custom Fields versions 6.2.0-6.8.10...

CVE-2026-97190

The Advanced Custom Fields (ACF®) WordPress plugin (versions 6.2.0 - 6.8.10 ) contains an authorization bypass vulnerability. The plugin fails to verify if a user is authorized to edit a target object during bidirectional relationship synchronization . This allows users with contributor-level acc...

CVE-2026-97190 Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR

The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own...

WordPress Advanced Custom Fields (ACF®) plugin < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update vulnerability

Contributor+ Admin-Restricted Custom Field Update vulnerability discovered by vuxvinh in WordPress Plugin Advanced Custom Fields versions 6.8.11...

CVE-2026-97189

The Advanced Custom Fields (ACF®) WordPress plugin versions before 6.8.11 is vulnerable to a read-permission check failure when rendering and formatting relational fields . This flaw allows users with post-editing access (e.g., Contributor level and above) to disclose the titles and non-public st...

EUVD-2026-118955

The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access Contributor and above to disclose the titles and non-public statuses of other users'...

EUVD-2026-118956

The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own...

EUVD-2026-118957

The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators...

CVE-2026-97191

The Advanced Custom Fields (ACF®) WordPress plugin versions before 6.8.11 contains a vulnerability where it fails to re-apply field-group location rules during the post editor save path. This allows users with contributor-level access and above to bypass restrictions and write custom fields that ...

WordPress Advanced Custom Fields (ACF®) plugin < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure vulnerability

Contributor+ Unpublished Post Title and Status Disclosure vulnerability discovered by vuxvinh in WordPress Plugin Advanced Custom Fields versions 6.8.11...

CVE-2026-97191 Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path

The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators...