Advisories · Technology
hwk-fr Advanced Custom Fields: Extended.
Every CVE that names hwk-fr Advanced Custom Fields: Extended among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection
- hwk-fr Advanced Custom Fields: Extended
- Information disclosure
- CVSS 5.3 Medium
Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints
- hwk-fr Advanced Custom Fields: Extended
- Broken access control
- CVSS 4.8 Medium
Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field
- hwk-fr Advanced Custom Fields: Extended
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter
- hwk-fr Advanced Custom Fields: Extended
- Privilege escalation
- CVSS 6.5 Medium
Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution
- hwk-fr Advanced Custom Fields: Extended
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action
- hwk-fr Advanced Custom Fields: Extended
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
- hwk-fr Advanced Custom Fields: Extended
- Code injection
- CVSS 6.4 Medium
Advanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- hwk-fr Advanced Custom Fields: Extended
- Cross-site scripting (XSS)