Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: ACF Extended Clear all filters
TI-2026-84138 CVE-2026-120534 · GHSA-v5v5-hmcv-q4fc

Code injection in Advanced Custom Fields: Extended PRO

Priority MEDIUM 49

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00312 Published 2026-11-03 No fix listed CWE-434
TI-2026-79249 CVE-2026-112313 · GHSA-x538-c3wf-pxfr

Stored cross-site scripting in WordPress ACF Extended plugin

Priority LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0019 Published 2026-10-22 No fix listed CWE-79
TI-2026-79235 CVE-2026-112311 · GHSA-q8wp-qw6f-5v3v

Path traversal in WordPress ACF Extended lets attackers delete files

Priority LOW 35

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00345 Published 2026-10-22 No fix listed CWE-22
TI-2026-79236 CVE-2026-112312 · GHSA-q37g-7cfq-9phh

Missing authorization in WordPress ACF Extended plugin

Priority LOW 39

Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00336 Published 2026-10-22 No fix listed CWE-862
TI-2021-07147 CVE-2021-24865 · GHSA-g65w-52r3-4hxv

Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection

Priority LOW 35

The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01502 Published 2022-01-24 Fixed in 0.8.8.7 CWE-89