Skip to content

Hwk-fr vulnerabilities

Products

Newest

hwk-fr advanced custom fields: extended Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection CVE-2026-110305 7.5 HighOctober 30, 2026
hwk-fr advanced custom fields: extended Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints CVE-2026-2839 5.3 MediumOctober 28, 2026
hwk-fr advanced custom fields: extended Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field CVE-2026-10752 4.8 MediumOctober 27, 2026
hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 more Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message CVE-2026-94263 4.8 MediumOctober 23, 2026
hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 more Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action CVE-2026-94268 8.1 HighOctober 23, 2026
hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 more Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action CVE-2026-94267 9.0 CriticalOctober 23, 2026
hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 more Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes CVE-2026-94264 6.8 MediumOctober 23, 2026
hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 more Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action CVE-2026-94262 8.1 HighOctober 23, 2026
hwk-fr advanced custom fields: extended Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action CVE-2026-80467 Public exploit 8.1 HighSeptember 2, 2026
hwk-fr advanced custom fields: extended Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action CVE-2026-12526 8.1 HighSeptember 2, 2026
hwk-fr advanced custom fields: extended Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter CVE-2026-8809 Public exploit 9.8 CriticalMay 28, 2026
hwk-fr advanced custom fields: extended Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution CVE-2025-15463 6.5 MediumMay 12, 2026
hwk-fr wp 404 auto redirect to similar post WP 404 Auto Redirect <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2025-12037 4.4 MediumFebruary 18, 2026
hwk-fr advanced custom fields: extended Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action CVE-2025-14533 9.8 CriticalJanuary 20, 2026
hwk-fr advanced custom fields: extended Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form CVE-2025-13486 Public exploit EPSS 68.6% 9.8 CriticalDecember 3, 2025
hwk-fr wp 404 auto redirect to similar post WordPress WP 404 Auto Redirect to Similar Post plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-32559 7.1 HighApril 18, 2024
hwk wp 404 auto redirect to similar post WP 404 Auto Redirect to Similar Post <= 1.0.3 - Reflected Cross-Site Scripting via request CVE-2024-0509 Public exploit 6.1 MediumFebruary 5, 2024
hwk-fr advanced custom fields: extended, acfextended advanced custom fields extended +1 more Advanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-5292 6.4 MediumOctober 20, 2023
hwk wp 404 auto redirect to similar post WordPress WP 404 Auto Redirect to Similar Post Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS) CVE-2023-40206 5.9 MediumSeptember 4, 2023
hwk-fr advanced custom fields: extended, acf-extended advanced custom fields\ +1 more Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection CVE-2021-24865 7.2 HighJanuary 24, 2022