Advanced Custom Fields (ACF®) vulnerabilities
We track 2 vulnerabilities in Advanced Custom Fields (ACF®) products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 6, 2026.
2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score
Latest Advanced Custom Fields (ACF®) vulnerabilities
- 7.5 High severity
Advanced Custom Fields (ACF®): Improper Neutralization of Input During Web Page Generation
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute nam
- 8.8 High severity
Advanced Custom Fields (ACF): Deserialization of Untrusted Data
The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is pr