ACF Extended vulnerabilities
We track 3 vulnerabilities in ACF Extended products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest ACF Extended vulnerabilities
- 9.8 Critical severity
Advanced Custom Fields: Extended PRO: Unrestricted Upload of File with Dangerous Type
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before me
- 7.1 High severity
ACF Extended: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7.
- 7.5 High severity
ACF Extended: Missing Authorization
Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.