Display custom fields in the frontend – Post and User Profile Fields

Display custom fields in the frontend – Post and User Profile Fields has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2024; all 4 are fixed as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 3 disclosures.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (25%). Other recurring categories include Code Injection, Cross-Site Scripting.

Every one of the 4 issues recorded for Display custom fields in the frontend – Post and User Profile Fields has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (3) reported by Francesco Carlucci. Display custom fields in the frontend – Post and User Profile Fields is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.5/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all Display custom fields in the frontend – Post and User Profile Fields vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2023-6996

Display custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Authenticated (Contributor+) Code Injection

Read the full analysis

Vulnerability Records

4 records
Plugin Profile
Latestv1.3.0

Display custom fields in the frontend – Post and User Profile Fields

Jose Vega

Author

Jose Vega

5.0(8)
100/100
Last Updated
2026-08-22 (21d ago)
Active Installs
500+
Downloads
13,614
Requires WP
4.1+
Requires PHP
0+
Tested up to
WP 7.1
Created
2017-07-24 (9y ago)

UPDATE Our plugin now includes a settings page where you must whitelist every field that you want our shortcode to display in the front end, for security reasons. Your existing shortcodes will not work until you whitelist those field keys. The “sanitization” parameter has been removed. All the output is sanitized with wp_kses_post always. The “wp_filter” parameter has been removed. Now we have more specific parameters like wpautop=”yes” to turn line breaks into paragraphs, and do_shortcodes=”yes” to parse shortcodes. Display post and user custom fields data anywhere on the frontend using a shortcode, including advanced custom fields (ACF) fields. Do you want to display information from a user profile on the frontend? Do you want to display custom fields from a post on the frontend? Have you created metaboxes with Advanced Custom Fields and you want to display those fields? Use this plugin to display any field for a post or user profile on the frontend. Basic examples Display email of the current user: [vg_display_data key="user_email" data_source="user_data"] Display first name of the current user: [vg_display_data key="first_name" data_source="user_meta"] Display full name of the current user: [vg_display_data key="first_name,last_name" data_source="user_meta"] Display the title of the current post: [vg_display_data key="post_title" data_source="post_data"] Display the excerpt of the current post: [vg_display_data key="post_excerpt" data_source="post_data"] Display the categories of the post ID = 20: [vg_display_data object_id="20" key="category" data_source="post_terms" template="<b>Categories:</b> {{var}}" joiner=", "] Get featured image url: [vg_display_data key="_thumbnail_id" template="<b>Image url:</b> {{var}}" flag="file_url"] Get featured image as <img> tag.: [vg_display_data key="_thumbnail_id" template="<b>Image:</b> {{var}}" flag="image_tag"] Advanced examples Display the title for the post ID from the URL containing the parameter ?post_id=ANY_NUMBER: [vg_display_data object_id_type="query_string" object_id="post_id" key="post_title" data_source="post_data"] Get email of the current user with phone number = 1234 (meta_key=phone AND meta_value=1234): [vg_display_data object_id_type="find" object_id="phone:1234" key="user_email" data_source="user_data"] Parameters object_id = Post ID. Leave empty to use the current post. Possible values: (empty), current, number, query string key if object_id_type=query_string, meta_key:meta_value if object_id_type=find object_id_type = Leave empty if object_id is empty, or current, or is a number. Possible values: query_string, find data_source = What database table to use to find the data. Default = post_meta. Possible values: post_data, post_meta, user_data, user_meta, post_terms. key = Field key. It accepts one or multiple keys separated by commas. For example, to display full name = first_name,last_name. Required. template = HTML fragment to use to display the field, if the field is empty the html is not displayed. Optional. default = Default value to use if the field is empty. Optional. joiner = If the field has multiple values, it will join the values with this string. Default ” ” (one space). Optional. flag = Use only if the field contains a file ID to conver the ID to URL or image tag. Default values: file_url , image_tag. Optional. wpautop = Whether to turn line breaks into paragraphs. Optional, only for advanced users. do_shortcodes = Whether to parse shortcodes before displaying the field value. Optional, only for advanced users.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C