Advanced Custom Fields (ACF®)

Explore Advanced Custom Fields (ACF®) vulnerabilities across all versions. Currently tracking 22 known vulnerabilities, including severity, impact, and patch status.

01234567891025.03.2011Today03.01.20133.8Advanced Custom Fields <= 3.5.1 - Remote Code Execution via Remote File Inclusion CVSS 3.8 · 03.01.201307.12.20185.4Advanced Custom Fields <= 5.7.7 - Author+ Stored Cross-Site Scripting CVSS 5.4 · 07.12.201815.02.20195.4Advanced Custom Fields <= 5.7.11 - PHP Object Injection CVSS 5.4 · 15.02.201910.06.20206.1Advanced Custom Fields <= 5.8.11 - Cross-Site Scripting CVSS 6.1 · 10.06.202002.12.20214.3Advanced Custom Fields <= 5.10 - Missing Authorization on Option Changes CVSS 4.3 · 02.12.20217.5Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure CVSS 7.5 · 02.12.20216.5Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure CVSS 6.5 · 02.12.202130.03.20226.5Advanced Custom Fields <= 5.12 - Authenticated Information Disclosure CVSS 6.5 · 30.03.202214.07.20224.3Advanced Custom Fields <= 5.12.2 - File Upload CVSS 4.3 · 14.07.202218.10.20224.3Advanced Custom Fields <= 6.0.2 - Authenticated (Contributor+) Information Disclosure CVSS 4.3 · 18.10.202203.04.20238.8Advanced Custom Fields <= 6.0.7 - Authenticated (Contributor+) PHP Object Injection CVSS 8.8 · 03.04.202304.05.20236.1Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5 & 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status' CVSS 6.1 · 04.05.202303.08.20234.4Advanced Custom Fields 6.1 - 6.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 03.08.202317.01.20246.4Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field CVSS 6.4 · 17.01.202430.05.20244.3Advanced Custom Fields <= 6.2.10 - Authenticated (Contributor+) Arbitrary Custom Field Access CVSS 4.3 · 30.05.202404.09.20245.5Advanced Custom Fields <= 6.3.5 - Authenticated Stored Cross-Site Scripting CVSS 5.5 · 04.09.202407.10.20245.1Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call CVSS 5.1 · 07.10.202415.10.20244.4Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 15.10.202408.08.20254.1Advanced Custom Fields <= 6.4.2. - HTML Injection CVSS 4.1 · 08.08.202514.04.20265.3Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters CVSS 5.3 · 14.04.202627.05.20265.3Advanced Custom Fields (ACF®) <= 6.8.1 - Missing Authorization CVSS 5.3 · 27.05.202630.05.20265.3Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters CVSS 5.3 · 30.05.2026

Strategic Overview

Avg CVSSMedium
5.4/ 10
Patch Coverage100%
Open

0

Fixed

22

Get automatic notifications for all Advanced Custom Fields (ACF®) vulnerabilities before they are exploited.

Vulnerability Records

22 records
2026-05-30 14:23CVE-2026-8382
5.3
Medium
Sarawut Poolkhet (MisterHelloz)Yes
2026-05-27 00:00N/A
5.3
Medium
Sarawut Poolkhet (MisterHelloz)Yes
2026-04-14 12:58CVE-2026-4812
5.3
Medium
Fernando MecozziYes
2025-08-08 00:00CVE-2025-54940
4.1
Medium
Shogo KumamaruYes
2024-10-15 00:00CVE-2024-49593
4.4
Medium
Duc Luong TranYes
2024-10-07 00:00CVE-2024-9529
5.1
Medium
AutomatticYes
2024-09-04 00:00CVE-2024-45429
5.5
Medium
Ryo SotoyamaYes
2024-05-30 00:00CVE-2024-4565
4.3
Medium
Francesco CarlucciYes
2024-01-17 00:00CVE-2023-6701
6.4
Medium
Francesco CarlucciYes
2023-08-03 00:00CVE-2023-40068
4.4
Medium
Satoo NakanoYes
Showing 1–10 of 22 reports
Advanced Custom Fields (ACF®) banner
Latestv6.8.6

Advanced Custom Fields (ACF®)

WP Engine

Author

WP Engine

4.5(1,437)
90/100
Last Updated
2026-07-14 (15d ago)
Active Installs
2,000,000+
Downloads
73,921,609
Requires WP
6.2+
Requires PHP
7.4+
Tested up to
WP 7.0.2
Created
2011-03-25 (16y ago)

Advanced Custom Fields (ACF®) turns WordPress sites into a fully-fledged content management system by giving you all the tools to do more with your data. Use the ACF plugin to take full control of your WordPress edit screens, custom field data, and more. Add fields on demand. The ACF field builder allows you to quickly and easily add fields to WP edit screens with only the click of a few buttons! Whether it’s something simple like adding an “author” field to a book review post, or something more complex like the structured data needs of an ecommerce site or marketplace, ACF makes adding fields to your content model easy. Add them anywhere. Fields can be added all over WordPress including posts, pages, users, taxonomy terms, media, comments and even custom options pages! It couldn’t be simpler to bring structure to the WordPress content creation experience. Show them everywhere. Load and display your custom field values in any theme template file with our hassle-free, developer friendly functions! Whether you need to display a single value or generate content based on a more complex query, the out-of-the-box functions of ACF make templating a dream for developers of all levels of experience. Any Content, Fast. Turning WordPress into a true content management system is not just about custom fields. Creating new custom post types and taxonomies is an essential part of building custom WordPress sites. Registering post types and taxonomies is now possible right in the ACF UI, speeding up the content modeling workflow without the need to touch code or use another plugin. Simply beautiful and intentionally accessible. For content creators and those tasked with data entry, the field user experience is as intuitive as they could desire while fitting neatly into the native WordPress experience. Accessibility standards are regularly reviewed and applied, ensuring ACF is able to empower as close to anyone as possible. Documentation and developer guides. Over 10 plus years of vibrant community contribution alongside an ongoing commitment to clear documentation means that you’ll be able to find the guidance you need to build what you want. Features Simple & Intuitive Powerful Functions Over 30 Field Types Extensive Documentation Millions of Users Links Website Documentation Support ACF PRO PRO The Advanced Custom Fields plugin is also available in a professional version which includes more fields, more functionality, and more flexibility. The ACF PRO plugin features: The Repeater Field allows you to create a set of sub fields which can be repeated again, and again, and again. ACF Blocks, a powerful PHP-based framework for developing custom block types for the WordPress Block Editor (aka Gutenberg). Define, create, and manage content with the Flexible Content Field, which provides for multiple layout and sub field options. Use the Options Page feature to add custom admin pages to edit ACF fields. Build fully customisable image galleries with the Gallery Field. Unlock a more efficient workflow for managing field settings by reusing existing fields and field groups on demand with the Clone Field. Upgrade to ACF PRO

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C