What’s Vulnerable › Products
hwk-fr Advanced Custom Fields: Extended vulnerabilities
8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.
Check whether your hwk-fr Advanced Custom Fields: Extended version is affected
Latest hwk-fr Advanced Custom Fields: Extended vulnerabilities
- CVE-2026-110305 — Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection (CVSS 7.5)
- CVE-2026-2839 — Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints (CVSS 5.3)
- CVE-2026-10752 — Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field (CVSS 4.8)
- CVE-2026-8809 — Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter (CVSS 9.8)
- CVE-2025-15463 — Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5)
- CVE-2025-14533 — Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action (CVSS 9.8)
- CVE-2025-13486 — Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form (CVSS 9.8)
- CVE-2023-5292 — Advanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)