Plugin security history

Advanced Custom Fields (ACF®) Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 22 vulnerability records associated with Advanced Custom Fields (ACF®), published between 2013 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

22Total records

0Critical

2High

19Medium

1Low

0Informational

22Patched records

0Currently marked unpatched

2013-01-03First disclosure

2026-05-30Latest disclosure

20 of 22CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2013	1	1 records
2018	1	1 records
2019	1	1 records
2020	1	1 records
2021	3	3 records
2022	3	3 records
2023	3	3 records
2024	5	5 records
2025	1	1 records
2026	3	3 records

Severity Breakdown

Severity	Records	Share
High	2	9.1%
Medium	19	86.4%
Low	1	4.5%

Vulnerability-Type Breakdown

Missing Authorization

8 records36.4%

First: 2021. Latest: 2026.

Cross-Site Scripting

7 records31.8%

First: 2018. Latest: 2024.

Other

5 records22.7%

First: 2013. Latest: 2025.

Information Disclosure

2 records9.1%

First: 2022. Latest: 2024.

Patch Status

Patched: 22
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

6.8.2
6.7.1
6.4.3
6.3.9
6.3.6.3
6.3.6
6.3.0
6.2.5
6.1.8
6.1.6
5.12.6
6.1.0
5.12.5
6.0.3
5.12.3
5.12.1
5.11
5.8.12
5.7.12
5.7.8
3.5.2

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-6.8.1`	Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters	May 30, 2026	6.8.2	Medium
`*-6.8.1`	Advanced Custom Fields (ACF®) <= 6.8.1 - Missing Authorization	May 27, 2026	6.8.2	Medium
`*-6.7.0`	Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters	April 14, 2026	6.7.1	Medium
`*-6.4.2`	Advanced Custom Fields <= 6.4.2. - HTML Injection	August 8, 2025	6.4.3	Medium
`6.3.8`	Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting	October 15, 2024	6.3.9	Medium
`6.3.7`	Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting	October 15, 2024	6.3.9	Medium
`*-6.3.6`	Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting	October 15, 2024	6.3.9	Medium
`*-6.3.6.2`	Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting	October 15, 2024	6.3.6.3	Medium
`6.3.8`	Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call	October 7, 2024	6.3.9	Medium
`6.3.7`	Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call	October 7, 2024	6.3.9	Medium
`*-6.3.6`	Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call	October 7, 2024	6.3.9	Medium
`*-6.3.6.2`	Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call	October 7, 2024	6.3.6.3	Medium
`*-6.3.5`	Advanced Custom Fields <= 6.3.5 - Authenticated Stored Cross-Site Scripting	September 4, 2024	6.3.6	Medium
`*-6.2.10`	Advanced Custom Fields <= 6.2.10 - Authenticated (Contributor+) Arbitrary Custom Field Access	May 30, 2024	6.3.0	Medium
`*-6.2.4`	Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field	January 17, 2024	6.2.5	Medium
`6.1-6.1.7`	Advanced Custom Fields 6.1 - 6.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting	August 3, 2023	6.1.8	Medium
`6.0.0-6.1.5`	Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5 & 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status'	May 4, 2023	5.12.6, 6.1.6	Medium
`5.8.10-5.12.5`	Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5 & 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status'	May 4, 2023	5.12.6, 6.1.6	Medium
`6.0.0-6.0.7`	Advanced Custom Fields <= 6.0.7 - Authenticated (Contributor+) PHP Object Injection	April 3, 2023	5.12.5, 6.1.0	High
`*-5.12.4`	Advanced Custom Fields <= 6.0.7 - Authenticated (Contributor+) PHP Object Injection	April 3, 2023	5.12.5, 6.1.0	High
`*-6.0.2`	Advanced Custom Fields <= 6.0.2 - Authenticated (Contributor+) Information Disclosure	October 18, 2022	6.0.3	Medium
`*-5.12.2`	Advanced Custom Fields <= 5.12.2 - File Upload	July 14, 2022	5.12.3	Medium
`[*, 5.12.1)`	Advanced Custom Fields <= 5.12 - Authenticated Information Disclosure	March 30, 2022	5.12.1	Medium
`[*, 5.11)`	Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure	December 2, 2021	5.11	Medium
`[*, 5.11)`	Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure	December 2, 2021	5.11	High

Selected source records

Latest Records

MediumCVE-2026-8382

Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters

Published: May 30, 2026

Affected versions: *-6.8.1
Patched versions: 6.8.2

Original Wordfence record

Medium

Advanced Custom Fields (ACF®) <= 6.8.1 - Missing Authorization

Published: May 27, 2026

Affected versions: *-6.8.1
Patched versions: 6.8.2

Original Wordfence record

MediumCVE-2026-4812

Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters

Published: April 14, 2026

Affected versions: *-6.7.0
Patched versions: 6.7.1

Original Wordfence record

MediumCVE-2025-54940

Advanced Custom Fields <= 6.4.2. - HTML Injection

Published: August 8, 2025

Affected versions: *-6.4.2
Patched versions: 6.4.3

Original Wordfence record

MediumCVE-2024-49593

Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting

Published: October 15, 2024

Affected versions: *-6.3.6.2
Patched versions: 6.3.6.3

Affected versions: *-6.3.6; 6.3.7; 6.3.8
Patched versions: 6.3.9

Affected versions: *-6.3.8
Patched versions: 6.3.9

Original Wordfence record

MediumCVE-2024-9529

Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call

Published: October 7, 2024

Affected versions: *-6.3.6.2
Patched versions: 6.3.6.3

Affected versions: *-6.3.6; 6.3.7; 6.3.8
Patched versions: 6.3.9

Affected versions: *-6.3.8
Patched versions: 6.3.9

Original Wordfence record

MediumCVE-2024-45429

Advanced Custom Fields <= 6.3.5 - Authenticated Stored Cross-Site Scripting

Published: September 4, 2024

Affected versions: *-6.3.5
Patched versions: 6.3.6

Affected versions: *-6.3.5
Patched versions: 6.3.6

Original Wordfence record

MediumCVE-2024-4565

Advanced Custom Fields <= 6.2.10 - Authenticated (Contributor+) Arbitrary Custom Field Access

Published: May 30, 2024

Affected versions: *-6.2.10
Patched versions: 6.3.0

Affected versions: *-6.2.10
Patched versions: 6.3.0

Original Wordfence record

Highest-Severity Records

HighCVE-2023-1196

Advanced Custom Fields <= 6.0.7 - Authenticated (Contributor+) PHP Object Injection

Published: April 3, 2023

Affected versions: *-5.12.4; 6.0.0-6.0.7
Patched versions: 5.12.5, 6.1.0

Original Wordfence record

HighCVE-2021-20865

Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure

Published: December 2, 2021

Affected versions: [*, 5.11)
Patched versions: 5.11

Affected versions: [*, 5.11)
Patched versions: 5.11

Original Wordfence record

MediumCVE-2022-23183

Advanced Custom Fields <= 5.12 - Authenticated Information Disclosure

Published: March 30, 2022

Affected versions: [*, 5.12.1)
Patched versions: 5.12.1

Affected versions: [*, 5.12.1)
Patched versions: 5.12.1

Original Wordfence record

MediumCVE-2021-20866

Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure

Published: December 2, 2021

Affected versions: [*, 5.11)
Patched versions: 5.11

Affected versions: [*, 5.11)
Patched versions: 5.11

Original Wordfence record

MediumCVE-2023-6701

Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field

Published: January 17, 2024

Affected versions: *-6.2.4
Patched versions: 6.2.5

Affected versions: *-6.2.4
Patched versions: 6.2.5

Original Wordfence record

MediumCVE-2020-36172

Advanced Custom Fields <= 5.8.11 - Cross-Site Scripting

Published: June 10, 2020

Affected versions: [*, 5.8.12)
Patched versions: 5.8.12

Original Wordfence record

MediumCVE-2023-30777

Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5 & 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status'

Published: May 4, 2023

Affected versions: 5.8.10-5.12.5; 6.0.0-6.1.5
Patched versions: 5.12.6, 6.1.6

Affected versions: 5.8.10-5.12.5; 6.0.0-6.1.5
Patched versions: 5.12.6, 6.1.6

Original Wordfence record

MediumCVE-2024-45429

Advanced Custom Fields <= 6.3.5 - Authenticated Stored Cross-Site Scripting

Published: September 4, 2024

Affected versions: *-6.3.5
Patched versions: 6.3.6

Affected versions: *-6.3.5
Patched versions: 6.3.6

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory