BuddyForms Advanced Custom Fields

BuddyForms Advanced Custom Fields has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2023; all 2 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

Every one of the 2 issues recorded for BuddyForms Advanced Custom Fields has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Rafie Muhammad. BuddyForms Advanced Custom Fields is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all BuddyForms Advanced Custom Fields vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4

BuddyForms ACF <= 1.3.8 - Authenticated (Contributor+) Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records


2023-07-18 00:00	Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get BuddyForms Advanced Custom Fields <= 1.3.4	`CVE-2023-33999`	6.1 Medium	Rafie Muhammad	Yes
2022-08-08 00:00	BuddyForms ACF <= 1.3.8 - Authenticated (Contributor+) Cross-Site Scripting BuddyForms Advanced Custom Fields <= 1.3.8	`N/A`	6.4 Medium	Anonymous	Yes

Showing 1–2 of 2 reports

Latestv1.3.20

BuddyForms Advanced Custom Fields

Author

Themekraft

3.3(4)

66/100

Last Updated

2026-02-11 (7mo ago)

Active Installs

100+

Downloads

20,421

Requires WP

4.0+

Requires PHP

Tested up to

WP 6.9.7

Created

2016-03-21 (11y ago)

This add-on lets you render ACF field groups inside BuddyForms so users can create and edit content from the frontend—while keeping ACF-powered meta in sync. Highlights – Works with ACF Free and PRO (ACF must be installed separately). – Map ACF field groups to BuddyForms forms for frontend create/edit. – Supports common ACF field types (text, textarea, select, checkbox, date, color, maps, etc.). – BuddyForms Moderation support for review/approval workflows. – BuddyPress integration: sync selected ACF fields with xProfile. Note: This plugin integrates with Advanced Custom Fields; it does not bundle any ACF code or assets.

View on WordPress.org