Advanced Custom Fields
Wpengine · 4 CVEs
CVE-2025-54940
MEDIUM
An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerabili…
Aug 8, 2025
CVE-2024-9529
MEDIUM
Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution
Nov 15, 2024
CVE-2024-45429
MEDIUM
Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fiel…
Sep 4, 2024
CVE-2024-4565
HIGH
Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access
Jun 20, 2024
CVE-2023-40068
MEDIUM
Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro ver…
Aug 21, 2023
CVE-2023-30777
HIGH
WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)
May 10, 2023
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2025-54940 | An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may b… | MEDIUM | 0.21% | Aug 8, 2025 |
| CVE-2024-9529 | Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution | MEDIUM | 0.43% | Nov 15, 2024 |
| CVE-2024-45429 | Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an… | MEDIUM | 0.42% | Sep 4, 2024 |
| CVE-2024-4565 | Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access | HIGH | 0.43% | Jun 20, 2024 |
| CVE-2023-40068 | Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote aut… | MEDIUM | 1.97% | Aug 21, 2023 |
| CVE-2023-30777 | WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS) | HIGH | 37.85% | May 10, 2023 |
Showing 1 to 4 of 4 CVEs