Unknown Custom Fields vulnerabilities

• unknown secure custom fields Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field Definition CVE-2026-97195 3.5 LowNovember 8, 2026
• unknown secure custom fields Secure Custom Fields < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields CVE-2026-97194 2.7 LowNovember 8, 2026
• unknown secure custom fields Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR CVE-2026-97193 2.7 LowNovember 8, 2026
• unknown secure custom fields Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path CVE-2026-97192 2.7 LowNovember 8, 2026
• unknown advanced custom fields (acf®) Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path CVE-2026-97191 2.7 LowNovember 7, 2026
• unknown advanced custom fields (acf®) Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR CVE-2026-97190 2.7 LowNovember 7, 2026
• unknown advanced custom fields (acf®) Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields CVE-2026-97189 2.7 LowNovember 7, 2026
• unknown advanced custom fields (acf®) Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection CVE-2026-110813 7.5 HighNovember 6, 2026
• acf extended advanced custom fields: extended pro Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type CVE-2026-120534 9.8 CriticalNovember 3, 2026
• hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 more Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message CVE-2026-94263 4.8 MediumOctober 23, 2026
• hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 more Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action CVE-2026-94268 8.1 HighOctober 23, 2026
• hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 more Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action CVE-2026-94267 9.0 CriticalOctober 23, 2026
• hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 more Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes CVE-2026-94264 6.8 MediumOctober 23, 2026
• hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 more Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action CVE-2026-94262 8.1 HighOctober 23, 2026
• unknown secure custom fields Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution CVE-2026-92403 3.7 LowSeptember 19, 2026
• hwk-fr advanced custom fields: extended Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action CVE-2026-80467 Public exploit 8.1 HighSeptember 2, 2026
• hwk-fr advanced custom fields: extended Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action CVE-2026-12526 8.1 HighSeptember 2, 2026
• unknown custom fields Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal CVE-2026-16940 10.0 CriticalAugust 5, 2026
• silverplugins217 custom fields account registration for woocommerce Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation CVE-2026-13152 Public exploit 8.1 HighJuly 27, 2026
• unknown product addons and product options with custom fields Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload CVE-2026-12968 8.8 HighJuly 22, 2026
• unknown advanced custom fields pro WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Cross-Site Request Forgery (CSRF) vulnerability CVE-2024-37251 4.3 MediumDecember 16, 2024
• advancedcustomfields advanced custom fields, unknown advanced custom fields pro, secure custom fields +1 more +3 more Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution CVE-2024-9529 6.6 MediumNovember 15, 2024
• unknown advanced custom fields pro WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Subscriber+ Broken Access Control vulnerability CVE-2024-37250 5.4 MediumNovember 1, 2024
• unknown advanced custom fields pro WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Contributor+ Broken Access Control vulnerability CVE-2024-37249 4.3 MediumNovember 1, 2024
• tassos.gr advanced custom fields, unknown advanced custom fields pro +1 more Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier... CVE-2024-45429 6.1 MediumSeptember 4, 2024
• advancedcustomfields advanced custom fields, unknown advanced custom fields (acf), advanced custom fields pro +1 more +3 more Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access CVE-2024-4565 6.5 MediumJune 20, 2024
• unknown advanced custom fields pro, wpengine advanced custom field pro +1 more Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Local File Inclusion vulnerability CVE-2024-34762 9.9 CriticalJune 10, 2024
• advancedcustomfields advanced custom fields, unknown advanced custom fields pro +1 more Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Arbitrary Function Execution vulnerability CVE-2024-34761 8.5 HighJune 10, 2024
• advancedcustomfields advanced custom fields, delicious brains advanced custom fields pro, wpengine advanced custom fields (acf®) +2 more Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field CVE-2023-6701 6.4 MediumFebruary 5, 2024
• advancedcustomfields advanced custom fields, unknown advanced custom fields (acf) +1 more WordPress Advanced Custom Fields Plugin 3.1.1-6.0.2 is vulnerable to Sensitive Data Exposure CVE-2022-40696 3.7 LowJanuary 8, 2024
• advancedcustomfields advanced custom fields, unknown advanced custom fields pro +1 more Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced... CVE-2023-40068 5.4 MediumAugust 21, 2023
• addify abandoned cart recovery, advanced free gifts, checkout fields manager +10 more +12 more Multiple Plugins from Addify - Multiple CSRF CVE-2022-4888 6.5 MediumJuly 31, 2023
• advancedcustomfields advanced custom fields, unknown advanced custom fields pro +1 more WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS) CVE-2023-30777 Public exploit EPSS 39.0% 7.1 HighMay 10, 2023
• advancedcustomfields advanced custom fields, unknown advanced custom fields (acf), advanced custom fields (acf) pro +2 more Advanced Custom Fields - Contributor+ PHP Object Injection CVE-2023-1196 8.8 HighMay 2, 2023
• cozmoslabs custom post types and custom fields creator WCK < 2.3.3 - Admin+ Stored XSS CVE-2022-4442 4.8 MediumJanuary 16, 2023
• advancedcustomfields advanced custom fields, todo advanced custom fields pro +1 more Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload CVE-2022-2594 8.8 HighAugust 22, 2022
• hwk-fr advanced custom fields: extended, acf-extended advanced custom fields\ +1 more Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection CVE-2021-24865 7.2 HighJanuary 24, 2022
• advancedcustomfields advanced custom fields, unknown advanced custom fields pro +1 more Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS) CVE-2021-24241 6.1 MediumApril 22, 2021