AC
Product
Advanced Custom Fields: Extended
7
CVEs
0
On KEV
9.0
Max CVSS
5
New 30D
Severity mix
Critical 1High 4Medium 2Low 0
Watch
Add Advanced Custom Fields: Extended to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-94267 New | 9.0 | Oct 23 | Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action Affected: before 0.9.2.8 |
| CVE-2026-94268 New | 8.1 | Oct 23 | Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action Affected: 0.9.2.7 before 0.9.2.8 |
| CVE-2026-94262 New | 8.1 | Oct 23 | Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action Affected: 0.9.2.7 before 0.9.2.8 |
| CVE-2026-80467 | 8.1 | Sep 2 | Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action Affected: 0.9.2.2 before 0.9.2.7 |
| CVE-2026-12526 | 8.1 | Sep 2 | Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action Affected: before 0.9.2.7 |
| CVE-2026-94264 New | 6.8 | Oct 23 | Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes Affected: 0.8.9.4 before 0.9.2.8 |
| CVE-2026-94263 New | 4.8 | Oct 23 | Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message Affected: 0.9.2.4 before 0.9.2.8 |
Showing 7