Advisories · Technology
Advanced Custom Fields: Extended.
Every CVE that names Advanced Custom Fields: Extended among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.8 Medium
Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message
- Advanced Custom Fields: Extended
- Advanced Custom Fields: Extended PRO
- Other injection
- CVSS 8.1 High
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
- Advanced Custom Fields: Extended
- Advanced Custom Fields: Extended PRO
- Privilege escalation
- CVSS 9.0 CriticalCritical · CVSS 9+
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action
- Advanced Custom Fields: Extended
- Advanced Custom Fields: Extended PRO
- Code injection
- CVSS 6.8 Medium
Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes
- Advanced Custom Fields: Extended
- Advanced Custom Fields: Extended PRO
- Cross-site scripting (XSS)
- CVSS 8.1 High
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action
- Advanced Custom Fields: Extended
- Advanced Custom Fields: Extended PRO
- Broken access control
- CVSS 8.1 High
Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action
- Advanced Custom Fields: Extended
- Privilege escalation
- CVSS 8.1 High
Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
- Advanced Custom Fields: Extended
- Authentication bypass
-
Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection
- Advanced Custom Fields: Extended
- SQL injection