Extension WordPress
Vulnérabilités Advanced Custom Fields Pro
Cette page rassemble les failles publiées pour Advanced Custom Fields Pro, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Advanced Custom Fields Pro
18 fiches
Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 – Authenticated (Admin+) Stored Cross-Site Scripting
The Advanced Custom Fields & Secure Custom Fields plugins for WordPress are vulnerable to Stored Cross-Site Scripting via ACF field labels in all versions up to, and including, 6.3.8 & 6.3.6.2 respectively due to insufficient input sanitization and…
*-6.3.8
6.3.9
15/10/2024
Advanced Custom Fields <= 6.3.8 – Authenticated (Admin+) Limited Arbitrary Function Call
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to limited arbitrary function calls via the 'register_meta_box_cb' and 'meta_box_cb' parameters in all versions up to, and including, 6.3.8 (excluding 6.3.6.2) due to insufficient input validation on those…
*-6.3.8
6.3.9
07/10/2024
Advanced Custom Fields <= 6.3.5 – Authenticated Stored Cross-Site Scripting
The Advanced Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via field groups in all versions up to, and including, 6.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
*-6.3.5
6.3.6
04/09/2024
Advanced Custom Fields PRO < 6.3.2 – Missing Authorization
The Advanced Custom Fields PRO plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to 6.3.2. This makes it possible for authenticated attackers, with contributor-level access and…
[*, 6.3.2)
6.3.2
26/06/2024
Advanced Custom Fields Pro <= 6.3.1 – Cross-Site Request Forgery
The Advanced Custom Fields Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.3.1. This is due to missing or incorrect nonce validation on a function. This makes it possible…
*-6.3.1
6.3.2
26/06/2024
Advanced Custom Fields Pro <= 6.3.1 – Missing Authorization
The Advanced Custom Fields Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.3.1. This makes it possible for authenticated attackers, with…
*-6.3.1
6.3.2
26/06/2024
Advanced Custom Fields Pro <= 6.3.1 – Missing Authorization
The Advanced Custom Fields Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.3.1. This makes it possible for authenticated attackers, with…
*-6.3.1
6.3.2
26/06/2024
Advanced Custom Fields <= 6.2.10 – Authenticated (Contributor+) Arbitrary Custom Field Access
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to arbitrary custom field access in all versions up to, and including, 6.2.10. This is due to the plugin not properly restricting what post meta can be displayed…
*-6.2.10
6.3.0
30/05/2024
Advanced Custom Fields Pro <= 6.2.9 – Authenticated (Contributor+) Local File Inclusion
The Advanced Custom Fields Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.2.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute…
*-6.2.9
6.2.10
15/05/2024
Advanced Custom Fields Pro <= 6.2.9 – Authenticated (Contributor+) Code Injection
The Advanced Custom Fields Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 6.2.9. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the…
*-6.2.9
6.2.10
15/05/2024
Advanced Custom Fields <= 6.2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it…
*-6.2.4
6.2.5
17/01/2024
Advanced Custom Fields PRO 6.1 – 6.1.7 – Authenticated (Administrator+) Stored Cross-Site Scripting
The Advanced Custom Fields PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 6.1 through 6.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
6.1-6.1.7
6.1.8
10/08/2023
Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5 & 6.0.0 to 6.1.5 – Reflected Cross-Site Scripting via 'post_status'
The Advanced Custom Fields (free & PRO) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_status' parameter in versions 5.8.10 to 5.12.5 and versions 6.0.0 to 6.1.5 due to insufficient input sanitization and output escaping.…
5.8.10-5.12.5, 6.0.0-6.1.5
5.12.6, 6.1.6
04/05/2023
Advanced Custom Fields <= 5.12 – Authenticated Information Disclosure
The Advanced Custom Fields plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 5.12. This makes it possible for authenticated attackers with editor access, such as Contributors…
[*, 5.12.1)
5.12.1
30/03/2022
Advanced Custom Fields <= 5.10 – Missing Authorization to Information Disclosure
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified…
[*, 5.11)
5.11
02/12/2021
Advanced Custom Fields <= 5.10 – Missing Authorization to Information Disclosure
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.
[*, 5.11)
5.11
02/12/2021
Advanced Custom Fields <= 5.10 – Missing Authorization on Option Changes
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via…
[*, 5.11)
5.11
02/12/2021
Advanced Custom Fields Pro <= 5.9.0 – Reflected Cross-Site Scripting
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.
[*, 5.9.1)
5.9.1
20/01/2021
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.