Advanced Custom Fields: Extended

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Advanced Custom Fields: Extended

Information

Software Type Plugin
Software Slug acf-extended (view on wordpress.org)
Software Status Active
Software Author hwk-fr
Software Website www.acf-extended.com
Software Downloads 2,558,191
Software Active Installs 100,000
Software Record Last Updated July 21, 2026

6 Vulnerabilities

Submit a Vulnerability
Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter
9.8
CVE-2026-8809
May 28, 2026
Researcher: daroo
Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVE-2025-15463
May 12, 2026
Researcher: Kishan Vyas
Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action
9.8
CVE-2025-14533
Jan 19, 2026
Researcher: andrea bocchetti
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
9.8
CVE-2025-13486
Dec 2, 2025
Researcher: Marcin Dudek (dudekmar)
Advanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2023-5292
Sep 29, 2023
Researcher: István Márton
Advanced Custom Fields: Extended <= 0.8.8.6 - Admin+ SQL Injection
7.2
CVE-2021-24865
Dec 24, 2021
Researcher: ZhongFu Su
Title Status CVE ID CVSS Researchers Date
Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter Patched CVE-2026-8809 9.8 daroo May 28, 2026
Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution Patched CVE-2025-15463 6.5 Kishan Vyas May 12, 2026
Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action Patched CVE-2025-14533 9.8 andrea bocchetti January 19, 2026
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form Patched CVE-2025-13486 9.8 Marcin Dudek (dudekmar) December 2, 2025
Advanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2023-5292 6.4 István Márton September 29, 2023
Advanced Custom Fields: Extended <= 0.8.8.6 - Admin+ SQL Injection Patched CVE-2021-24865 7.2 ZhongFu Su December 24, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation