Is Advanced Custom Fields (ACF®) safe?

Every recorded flaw

• May 31, 2026Advanced Custom Fields (ACF®): Authorization bypassCVE-2026-8382 · affects up to 6.8.1 · reported by WordfenceMedium 5.3
• Apr 15, 2026Advanced Custom Fields (ACF): Missing Authorization to Arbitrary Post/Page DisclosureCVE-2026-4812 · affects up to 6.7.0 · reported by WordfenceMedium 5.3
• Aug 5, 2025core/actions/export.php: The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI)CVE-2012-10025 · reported by VulnCheck2.0% oddsCritical 10
• Oct 17, 2024In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plCVE-2024-49593 · fixed in 6.3.9 · reported by MITREMedium 5.3
• Sep 4, 2024Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier.CVE-2024-45429 · affects up to 6.3.5 · reported by vultures@jpcert.or.jpMedium 6.1
• Jun 20, 2024The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values fCVE-2024-4565 · fixed in 6.3 · reported by WPScanMedium 6.5
• Feb 5, 2024Advanced Custom Fields (ACF): Stored Cross-Site ScriptingCVE-2023-6701 · affects up to 6.2.4 · reported by WordfenceMedium 6.4
• Jan 8, 2024Advanced Custom Fields (ACF): Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-40696 · affects up to 6.0.2 · reported by PatchstackLow 3.7
• Aug 21, 2023Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7: Cross-site scriptingCVE-2023-40068 · reported by vultures@jpcert.or.jp2.0% oddsMedium 5.4
• Mar 31, 2022Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1: Missing authorizationCVE-2022-23183 · reported by vultures@jpcert.or.jp1.5% oddsMedium 6.5
• Dec 13, 2021moving the field group which may allow a user to move the unauthorized field group: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20867 · reported by vultures@jpcert.or.jp1.5% oddsMedium 6.5
• Dec 13, 2021obtaining the user list which may allow a user to obtain the unauthorized information: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20866 · reported by vultures@jpcert.or.jp1.8% oddsMedium 6.5
• Dec 13, 2021browsing database which may allow a user to browse unauthorized data: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20865 · reported by vultures@jpcert.or.jp2.6% oddsHigh 7.5
• Jan 6, 2021The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.CVE-2020-36172 · fixed in 5.8.12 · reported by MITREMedium 6.1
• Aug 22, 2019The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.CVE-2018-20986 · fixed in 5.7.8 · reported by MITREMedium 5.4

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.