Read the docs

ACF Extended

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

ACF Extended records in CISA KEV

No ACF Extended vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Advanced Custom Fields 1 record LOW

Records

6 records

TI-2026-84138 CVE-2026-120534 · GHSA-v5v5-hmcv-q4fc

Code injection in Advanced Custom Fields: Extended PRO

Priority MEDIUM 49

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00312 Published 2026-11-03 No fix listed CWE-434
TI-2026-79236 CVE-2026-112312 · GHSA-q37g-7cfq-9phh

Missing authorization in WordPress ACF Extended plugin

Priority LOW 39

Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00336 Published 2026-10-22 No fix listed CWE-862
TI-2026-79235 CVE-2026-112311 · GHSA-q8wp-qw6f-5v3v

Path traversal in WordPress ACF Extended lets attackers delete files

Priority LOW 35

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00345 Published 2026-10-22 No fix listed CWE-22
TI-2021-07147 CVE-2021-24865 · GHSA-g65w-52r3-4hxv

Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection

Priority LOW 35

The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01502 Published 2022-01-24 Fixed in 0.8.8.7 CWE-89
TI-2026-79249 CVE-2026-112313 · GHSA-x538-c3wf-pxfr

Stored cross-site scripting in WordPress ACF Extended plugin

Priority LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0019 Published 2026-10-22 No fix listed CWE-79
Open these records in search →