Wpengine vulnerabilities

Products

• Database Backup For Wordpress 6
• Wpgraphql 5
• Advanced Custom Field Pro 3
• Advanced Custom Fields 3
• Advanced Custom Fields (acf®) 3
• Genesis Blocks 3
• Better Search Replace 2

Newest

• wpengine faustjs FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope CVE-2026-54239 8.8 HighSeptember 17, 2026
• wpengine advanced custom fields (acf®) Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters CVE-2026-8382 5.3 MediumMay 31, 2026
• wpengine database backup for wordpress Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion CVE-2026-4030 8.1 HighMay 14, 2026
• wpengine database backup for wordpress Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export CVE-2026-4029 7.5 HighMay 14, 2026
• wpengine database backup for wordpress Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception CVE-2026-4031 7.5 HighMay 14, 2026
• wpengine advanced custom fields (acf®) Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters CVE-2026-4812 5.3 MediumApril 15, 2026
• wpengine wp migrate lite – migration made easy WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery CVE-2025-11427 5.8 MediumNovember 18, 2025
• unknown genesis blocks Genesis Blocks <= 3.1.3 - Contributor+ Stored XSS CVE-2024-3901 6.8 MediumMay 15, 2025
• advancedcustomfields advanced custom fields, unknown advanced custom fields pro, secure custom fields +1 more +3 more Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution CVE-2024-9529 6.6 MediumNovember 15, 2024
• 5starplugins easy age verify, featured images in rss for mailchimp & more, marijuana age verify +619 more +621 more Freemius SDK <= 2.4.2 - Missing Authorization Checks CVE-2022-4974 6.3 MediumOctober 16, 2024
• tassos.gr advanced custom fields, unknown advanced custom fields pro +1 more Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier... CVE-2024-45429 6.1 MediumSeptember 4, 2024
• studiopress genesis blocks Genesis Blocks <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributes CVE-2024-3563 6.4 MediumJuly 9, 2024
• advancedcustomfields advanced custom fields, unknown advanced custom fields (acf), advanced custom fields pro +1 more +3 more Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access CVE-2024-4565 6.5 MediumJune 20, 2024
• unknown advanced custom fields pro, wpengine advanced custom field pro +1 more Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Local File Inclusion vulnerability CVE-2024-34762 9.9 CriticalJune 10, 2024
• studiopress genesis blocks Genesis Blocks < 3.1.3 - Contributor+ Stored XSS CVE-2024-2761 6.8 MediumApril 19, 2024
• wpengine wp migrate WordPress WP Migrate plugin <= 2.6.10 - Unauthenticated PHP Object Injection vulnerability CVE-2024-30225 10.0 CriticalMarch 28, 2024
• advancedcustomfields advanced custom fields, delicious brains advanced custom fields pro, wpengine advanced custom fields (acf®) +2 more Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field CVE-2023-6701 6.4 MediumFebruary 5, 2024
• wpengine better search replace Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection CVE-2023-6933 Public exploit EPSS 68.0% 8.8 HighFebruary 5, 2024
• wpengine wpgraphql, unknown wp-graphql-woocommerce +1 more WPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes Disclosure CVE-2022-1563 5.3 MediumJanuary 16, 2024
• wp engine php compatibility checker WordPress PHP Compatibility Checker Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-24421 5.4 MediumJuly 11, 2023
• wpengine wpgraphql WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF) CVE-2023-23684 Fix available 4.4 MediumJune 30, 2023
• deliciousbrains better search replace Better Search and Replace < 1.4.1 - Admin+ SQLi CVE-2022-2593 7.2 HighAugust 22, 2022
• deliciousbrains database backup, unknown database backup for wordpress +1 more Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRF CVE-2022-1577 5.4 MediumJune 6, 2022
• deliciousbrains database backup, unknown database backup for wordpress +1 more Database Backup for WordPress < 2.5.1 - Admin+ SQL Injection CVE-2022-0255 7.2 HighFebruary 21, 2022
• delicious brains database backup for wordpress, deliciousbrains database backup +1 more Database Backup for WordPress < 2.4 - Authenticated Persistent Cross-Site Scripting (XSS) CVE-2021-24322 5.4 MediumJune 1, 2021
• wpengine wpgraphql The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated... CVE-2019-9881 Public exploit EPSS 18.4% 5.3 MediumJune 10, 2019
• wpengine wpgraphql An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users'... CVE-2019-9880 Public exploit EPSS 34.8% 9.1 CriticalJune 10, 2019
• wpengine wpgraphql The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with... CVE-2019-9879 Public exploit EPSS 45.7% 9.8 CriticalJune 10, 2019