1406 matches found
CVE-2026-13152
CVE-2026-13152: Unauthenticated Privilege Escalation in Custom Fields Account Registration For WooCommerce 1.4 -blue.svg 📖 Advisory Overview CVE-2026-13152 is an unauthenticated privilege escalation vulnerability affecting the Custom Fields Account Registration For WooCommerce WordPress plugin...
CVE-2023-30777
CVE-2023-30777 Proof of Concept PoC URL generator for a reflected XSS vulnerability in the Advanced Custom Fields WordPress plugin. PoC Generate by : Alucard0x1 Credit of Exploit : https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites/...
CVE-2025-13486
🔴 CVE-2025-13486 - Advanced Custom Fields Extended ACFE WordPress Plugin Exploit 📋 Overview Proof-of-concept exploit for CVE-2025-13486 , a critical vulnerability in the Advanced Custom Fields: Extended ACFE WordPress plugin that allows Remote Code Execution leading to Privilege Escalation. 🎯...
CVE-2025-13486
Mass Exploit CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepareform ⚠️ Vulnerability Details The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via th...
CVE-2026-110305
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user...
CVE-2026-110305 Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user...
EUVD-2026-114215
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user...
CVE-2026-110305
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 0.9.2.7 . The root cause involves the processing of the acf[] parameter, where an unauthenticated attacker can inject a {get_user} template tag. If an admi...
CVE-2026-110305 Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user...
CVE-2026-110305: hwk-fr Advanced Custom Fields: Extended: The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all…
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user...
PT-2026-133697
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user...
WordPress Meta Box – A Framework for Dynamic Websites plugin <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Meta Box – WordPress Custom Fields Framework versions = 5.15.2...
CVE-2026-2839
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users wpajaxnopriv that fail to implemen...
CVE-2026-2839
The Advanced Custom Fields: Extended plugin for WordPress (versions up to and including 0.9.2.7 ) is vulnerable to unauthorized data exposure and server-side actions. The root cause is that multiple AJAX handlers registered for unauthenticated users (wp_ajax_nopriv_*) lack proper current_user_can...
CVE-2026-2839 Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users wpajaxnopriv that fail to implemen...
EUVD-2026-111603
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users wpajaxnopriv that fail to implemen...
PT-2026-127780
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom fieldsembedcode' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and outpu...
PT-2026-127887
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users wp ajax nopriv that fail to...
WordPress Product Addons for Woocommerce – Product Options with Custom Fields plugin <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting vulnerability
Authenticated Shop Manager+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Product Addons for Woocommerce versions = 3.1.8...
CVE-2026-10752
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...