WordPress Secure Custom Fields plugin < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update vulnerability

Contributor+ Admin-Restricted Custom Field Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Secure Custom Fields versions 6.9.8...

WordPress Advanced Custom Fields (ACF®) plugin < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update vulnerability

Contributor+ Admin-Restricted Custom Field Update vulnerability discovered by vuxvinh in WordPress Plugin Advanced Custom Fields versions 6.8.11...

CVE-2026-97191

The Advanced Custom Fields (ACF®) WordPress plugin versions before 6.8.11 contains a vulnerability where it fails to re-apply field-group location rules during the post editor save path. This allows users with contributor-level access and above to bypass restrictions and write custom fields that ...

CVE-2025-12937

The ACF Flexible Layouts Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'acfflmupdatetemplatewithpastedlayout' function in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers to...

GHSA-CVRM-CR3M-QJ92 MantisBT XSS in manage_custom_field_update.php

An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the helperensureconfirmed call in managecustomfieldupdate.php, where the custom field name is not properly sanitized. An attacker can inject malicious scripts...