Advanced Custom Fields (ACF®)

WordPress plugin · advanced-custom-fields · WordPress.org ↗

Latest v6.8.10 Last release Sep 10, 2026 Tested up to WP 7.1.1 2,000,000+ active installs

Critical

High

Known total

Unfixed

Running Advanced Custom Fields (ACF®) on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
CRITICAL CVSS 10.0	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 3.5.2 WPVulnerability · PoC available	< 3.5.2	v3.5.2	CVE-2012-10025	Jan 3, 2013
HIGH CVSS 7.1	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.1.6 WPVulnerability	< 6.1.6	v6.1.6	CVE-2023-30777	May 4, 2023
HIGH CVSS 8.8	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.12.5 WPVulnerability · PoC available	< 5.12.5	v5.12.5	CVE-2023-1196	Apr 3, 2023
HIGH CVSS 8.8	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.12.3 WPVulnerability	< 5.12.3	v5.12.3	CVE-2022-2594	Jul 14, 2022
HIGH CVSS 7.5	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.11 WPVulnerability	< 5.11	v5.11	CVE-2021-20865	Dec 2, 2021
MEDIUM CVSS 5.3	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.8.2 WPVulnerability	< 6.8.2	v6.8.2	CVE-2026-8382	May 30, 2026
MEDIUM CVSS 5.3	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.7.1 WPVulnerability	< 6.7.1	v6.7.1	CVE-2026-4812	Apr 14, 2026
MEDIUM CVSS 5.3	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.3.9 WPVulnerability	< 6.3.9	v6.3.9	CVE-2024-49593	Oct 15, 2024
MEDIUM CVSS 6.6	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.3.8 WPVulnerability · PoC available	< 6.3.8	v6.3.8	CVE-2024-9529	Oct 7, 2024
MEDIUM CVSS 6.1	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.3.6 WPVulnerability	< 6.3.6	v6.3.6	CVE-2024-45429	Sep 4, 2024
MEDIUM CVSS 6.5	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.3.0 WPVulnerability · PoC available	< 6.3.0	v6.3.0	CVE-2024-4565	May 30, 2024
MEDIUM CVSS 5.4	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.2.5 WPVulnerability	< 6.2.5	v6.2.5	CVE-2023-6701	Jan 17, 2024
MEDIUM CVSS 5.4	Advanced Custom Fields (ACF®) [advanced-custom-fields] >= 6.1.0 - <= 6.1.7 WPVulnerability	>= 6.1.0, <= 6.1.7	patched	CVE-2023-40068	Aug 3, 2023
MEDIUM CVSS 6.5	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.12.1 WPVulnerability	< 5.12.1	v5.12.1	CVE-2022-23183	Mar 30, 2022
MEDIUM CVSS 6.5	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.11 WPVulnerability	< 5.11	v5.11	CVE-2021-20866	Dec 2, 2021
MEDIUM CVSS 6.5	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.12.1 WPVulnerability	< 5.12.1	v5.12.1	CVE-2021-20867	Dec 2, 2021
MEDIUM CVSS 6.1	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.8.12 WPVulnerability	< 5.8.12	v5.8.12	CVE-2020-36172	Jun 10, 2020
MEDIUM CVSS 5.4	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.7.8 WPVulnerability	< 5.7.8	v5.7.8	CVE-2018-20986	Dec 7, 2018
LOW CVSS 3.4	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.4.3 WPVulnerability	< 6.4.3	v6.4.3	CVE-2025-54940	Aug 8, 2025
LOW CVSS 3.7	Advanced Custom Fields (ACF®) [advanced-custom-fields] >= 3.1.1 - <= 6.0.2 WPVulnerability	>= 3.1.1, <= 6.0.2	patched	CVE-2022-40696	Oct 18, 2022
UNKNOWN	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.8.2 WPVulnerability	< 6.8.2	v6.8.2	—	May 27, 2026
UNKNOWN	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 3.5.2 WPVulnerability	< 3.5.2	v3.5.2	—	Aug 5, 2025
UNKNOWN	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.3.9 WPVulnerability	< 6.3.9	v6.3.9	—	Oct 16, 2024
UNKNOWN	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.2.5 WPVulnerability	< 6.2.5	v6.2.5	—	Jan 16, 2024
UNKNOWN	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.1.8 WPVulnerability	< 6.1.8	v6.1.8	—	Aug 3, 2023
UNKNOWN	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.12.5 WPVulnerability	< 5.12.5	v5.12.5	—	Apr 4, 2023
UNKNOWN	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.10 WPVulnerability	< 5.10	v5.10	—	Aug 25, 2021
UNKNOWN	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.7.12 WPVulnerability	< 5.7.12	v5.7.12	—	Feb 15, 2019
UNKNOWN	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.7.8 WPVulnerability	< 5.7.8	v5.7.8	—	Dec 10, 2018
UNKNOWN	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 1.1.13 WPVulnerability	< 1.1.13	v1.1.13	—	Aug 8, 2016
UNKNOWN	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 3.5.2 WPVulnerability	< 3.5.2	v3.5.2	—	Jan 3, 2013
UNKNOWN	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 5.7.12 WPVulnerability	< 5.7.12	v5.7.12	—	—
UNKNOWN	Advanced Custom Fields (ACF®) [advanced-custom-fields] < 3.5.2 WPVulnerability	< 3.5.2	v3.5.2	—	—

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.