Advanced Custom Field Pro

Vulnerabilities 20Slug advanced-custom-fields-proLatest version 5.12.2Plugin page →

Minimum safe version

6.3.9

Update to 6.3.9 or later to address 19 fixable vulnerabilities

Latest available5.12.2 ✗Affected up to6.1.7 ⚠
N/A
2024-10-16< 6.3.9

WordPress Advanced Custom Fields PRO Plugin <= 6.3.8 is vulnerable to Cross Site Scripting (XSS)

Patchstack
N/A
2024-10-15< 6.3.9

Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting

Wordfence
N/A
2024-10-07< 6.3.8

Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call

Wordfence
N/A
< 6.2.5

Advanced Custom Fields &lt; 6.2.5 - Contributor+ Stored Cross-Site Scripting via Custom Field

WPScan
N/A
2024-01-16< 6.2.5

WordPress Advanced Custom Fields PRO Plugin < 6.2.5 is vulnerable to Cross Site Scripting (XSS)

Patchstack
N/A
2023-08-10< 6.1.8

Advanced Custom Fields PRO 6.1 - 6.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

Wordfence
N/A
2023-08-10≥ 6.1 and ≤ 6.1.7

WordPress Advanced Custom Fields PRO Plugin 6.1-6.1.7 is vulnerable to Cross Site Scripting (XSS)

Patchstack
Medium 6.5
2025-10-03< 5.12.1

WordPress Advanced Custom Fields PRO Plugin < 5.11 is vulnerable to Broken Access Control

EUVDPatchstackCVEWPScan