Vulnerabilities

TI-2026-83241 CVE-2026-110305 · GHSA-6gvj-qmj9-cj2m

Advanced Custom Fields: Extended exposes user password hashes

MEDIUM 40

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00613 Published 2026-10-30 No fix listed CWE-200

TI-2026-81718 CVE-2026-2839 · GHSA-6687-wfp7-4mp6

Missing authorization in Advanced Custom Fields: Extended

LOW 30

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00275 Published 2026-10-28 No fix listed CWE-862

TI-2026-81124 CVE-2026-10752 · GHSA-59c3-wg76-7px2

Missing authorization in Advanced Custom Fields: Extended deletes files

LOW 22

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00253 Published 2026-10-27 No fix listed CWE-862

TI-2026-07743 CVE-2026-8809 · GHSA-jvvq-c627-79xm

Improper privilege management in hwk-fr Advanced Custom Fields: Extended

MEDIUM 50

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypass in all versions up to and including 0.9.2.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.008 Published 2026-05-28 No fix listed CWE-269

TI-2025-14104 CVE-2025-15463 · GHSA-7qqg-rvf9-85ww

Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution

LOW 35

The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00381 Published 2026-05-12 No fix listed CWE-94

TI-2025-11036 CVE-2025-12037 · GHSA-4292-3qv2-cv3v

WP 404 Auto Redirect <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting

LOW 20

The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output…

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00216 Published 2026-02-18 No fix listed CWE-79

TI-2025-13276 CVE-2025-14533 · GHSA-jm76-5g2j-p4hp

Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action

MEDIUM 52

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.9.2.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01495 Published 2026-01-20 No fix listed CWE-269

TI-2025-12329 CVE-2025-13486 · GHSA-8q8p-fv92-864w

Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form

CRITICAL 86

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.68598 Published 2025-12-03 No fix listed CWE-94

TI-2024-21446 CVE-2024-32559 · GHSA-fm4q-g78h-5f4m

WordPress WP 404 Auto Redirect to Similar Post plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hwk-fr WP 404 Auto Redirect to Similar Post allows Reflected XSS.This issue affects WP 404 Auto Redirect to Similar Po…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00394 Published 2024-04-18 No fix listed CWE-79

Vulnerabilities

Filters