Advanced Custom Fields (ACF) Archives - Standoutmedia A/S

Stored Cross-Site Scripting in Advanced Custom Fields Field Group Editor

Skrevet den 15. oktober 2026 af i Advanced Custom Fields (ACF)

The Field Group editor renders each field’s label into the field list without escaping it, so a field label containing HTML markup is executed as script in the browser of any administrator who opens or edits that field group. The fix HTML-escapes the label before it is rendered.

This vulnerability affects the following application versions:

Advanced Custom Fields (ACF) 5.9.0
Advanced Custom Fields (ACF) 5.9.1
Advanced Custom Fields (ACF) 5.9.2
Advanced Custom Fields (ACF) 5.9.3
Advanced Custom Fields (ACF) 5.9.4
Advanced Custom Fields (ACF) 5.9.5
Advanced Custom Fields (ACF) 5.9.6
Advanced Custom Fields (ACF) 5.9.7
Advanced Custom Fields (ACF) 5.9.8
Advanced Custom Fields (ACF) 5.9.9
Advanced Custom Fields (ACF) 5.10
Advanced Custom Fields (ACF) 5.10.1
Advanced Custom Fields (ACF) 5.10.2
Advanced Custom Fields (ACF) 5.11
Advanced Custom Fields (ACF) 5.11.1
Advanced Custom Fields (ACF) 5.11.2
Advanced Custom Fields (ACF) 5.11.3
Advanced Custom Fields (ACF) 5.11.4
Advanced Custom Fields (ACF) 5.12
Advanced Custom Fields (ACF) 5.12.1
Advanced Custom Fields (ACF) 5.12.2
Advanced Custom Fields (ACF) 5.12.3
Advanced Custom Fields (ACF) 5.12.4
Advanced Custom Fields (ACF) 5.12.5
Advanced Custom Fields (ACF) 5.12.6
Advanced Custom Fields (ACF) 6.0.0
Advanced Custom Fields (ACF) 6.0.1
Advanced Custom Fields (ACF) 6.0.2
Advanced Custom Fields (ACF) 6.0.3
Advanced Custom Fields (ACF) 6.0.4
Advanced Custom Fields (ACF) 6.0.5
Advanced Custom Fields (ACF) 6.0.6
Advanced Custom Fields (ACF) 6.0.7
Advanced Custom Fields (ACF) 6.1.0
Advanced Custom Fields (ACF) 6.1.1
Advanced Custom Fields (ACF) 6.1.2
Advanced Custom Fields (ACF) 6.1.3
Advanced Custom Fields (ACF) 6.1.4
Advanced Custom Fields (ACF) 6.1.5
Advanced Custom Fields (ACF) 6.1.6
Advanced Custom Fields (ACF) 6.1.7
Advanced Custom Fields (ACF) 6.1.8
Advanced Custom Fields (ACF) 6.2.0
Advanced Custom Fields (ACF) 6.2.1
Advanced Custom Fields (ACF) 6.2.2
Advanced Custom Fields (ACF) 6.2.3
Advanced Custom Fields (ACF) 6.2.4
Advanced Custom Fields (ACF) 6.2.5
Advanced Custom Fields (ACF) 6.2.6
Advanced Custom Fields (ACF) 6.2.6.1
Advanced Custom Fields (ACF) 6.2.7
Advanced Custom Fields (ACF) 6.2.8
Advanced Custom Fields (ACF) 6.2.9
Advanced Custom Fields (ACF) 6.3.0
Advanced Custom Fields (ACF) 6.3.1
Advanced Custom Fields (ACF) 6.3.2
Advanced Custom Fields (ACF) 6.3.3
Advanced Custom Fields (ACF) 6.3.4
Advanced Custom Fields (ACF) 6.3.5
Advanced Custom Fields (ACF) 6.3.6
Advanced Custom Fields (ACF) 6.3.6.1
Advanced Custom Fields (ACF) 6.3.6.2
Advanced Custom Fields (ACF) 6.3.6.3
Advanced Custom Fields (ACF) 6.3.9
Advanced Custom Fields (ACF) 6.3.10.2

Unsafe html in field group labels vulnerable to js execution in the classic editor

Skrevet den 28. maj 2026 af i Advanced Custom Fields (ACF)

The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 6.4.2. This is due to the plugin nor properly neutralizing unsafe HTML. This makes it possible for authenticated attackers, with administrator-level access and above, to inject potentially malicious HTML.

This vulnerability affects the following application versions:

Advanced Custom Fields (ACF) 5.9.0
Advanced Custom Fields (ACF) 5.9.1
Advanced Custom Fields (ACF) 5.9.2
Advanced Custom Fields (ACF) 5.9.3
Advanced Custom Fields (ACF) 5.9.4
Advanced Custom Fields (ACF) 5.9.5
Advanced Custom Fields (ACF) 5.9.6
Advanced Custom Fields (ACF) 5.9.7
Advanced Custom Fields (ACF) 5.9.8
Advanced Custom Fields (ACF) 5.9.9
Advanced Custom Fields (ACF) 5.10
Advanced Custom Fields (ACF) 5.10.1
Advanced Custom Fields (ACF) 5.10.2
Advanced Custom Fields (ACF) 5.11
Advanced Custom Fields (ACF) 5.11.1
Advanced Custom Fields (ACF) 5.11.2
Advanced Custom Fields (ACF) 5.11.3
Advanced Custom Fields (ACF) 5.11.4
Advanced Custom Fields (ACF) 5.12
Advanced Custom Fields (ACF) 5.12.1
Advanced Custom Fields (ACF) 5.12.2
Advanced Custom Fields (ACF) 5.12.3
Advanced Custom Fields (ACF) 5.12.4
Advanced Custom Fields (ACF) 5.12.5
Advanced Custom Fields (ACF) 5.12.6
Advanced Custom Fields (ACF) 6.0.0
Advanced Custom Fields (ACF) 6.0.1
Advanced Custom Fields (ACF) 6.0.2
Advanced Custom Fields (ACF) 6.0.3
Advanced Custom Fields (ACF) 6.0.4
Advanced Custom Fields (ACF) 6.0.5
Advanced Custom Fields (ACF) 6.0.6
Advanced Custom Fields (ACF) 6.0.7
Advanced Custom Fields (ACF) 6.1.0
Advanced Custom Fields (ACF) 6.1.1
Advanced Custom Fields (ACF) 6.1.2
Advanced Custom Fields (ACF) 6.1.3
Advanced Custom Fields (ACF) 6.1.4
Advanced Custom Fields (ACF) 6.1.5
Advanced Custom Fields (ACF) 6.1.6
Advanced Custom Fields (ACF) 6.1.7
Advanced Custom Fields (ACF) 6.1.8
Advanced Custom Fields (ACF) 6.2.0
Advanced Custom Fields (ACF) 6.2.1
Advanced Custom Fields (ACF) 6.2.2
Advanced Custom Fields (ACF) 6.2.3
Advanced Custom Fields (ACF) 6.2.4
Advanced Custom Fields (ACF) 6.2.5
Advanced Custom Fields (ACF) 6.2.6
Advanced Custom Fields (ACF) 6.2.6.1
Advanced Custom Fields (ACF) 6.2.7
Advanced Custom Fields (ACF) 6.2.8
Advanced Custom Fields (ACF) 6.2.9
Advanced Custom Fields (ACF) 6.3.0
Advanced Custom Fields (ACF) 6.3.1
Advanced Custom Fields (ACF) 6.3.2
Advanced Custom Fields (ACF) 6.3.3
Advanced Custom Fields (ACF) 6.3.4
Advanced Custom Fields (ACF) 6.3.5
Advanced Custom Fields (ACF) 6.3.6
Advanced Custom Fields (ACF) 6.3.6.1
Advanced Custom Fields (ACF) 6.3.6.2
Advanced Custom Fields (ACF) 6.3.6.3
Advanced Custom Fields (ACF) 6.3.9
Advanced Custom Fields (ACF) 6.3.10.2
Advanced Custom Fields (ACF) 6.3.11
Advanced Custom Fields (ACF) 6.3.12
Advanced Custom Fields (ACF) 6.4.0
Advanced Custom Fields (ACF) 6.4.0.1
Advanced Custom Fields (ACF) 6.4.1
Advanced Custom Fields (ACF) 6.4.2

Authorization bypass in User field AJAX query handler

Skrevet den 12. maj 2026 af i Advanced Custom Fields (ACF)

The acf/fields/user/query AJAX endpoint inherited unfiltered request parameters into WP_User_Query args, so a user with access to the field UI could override the field’s configured role restriction (role__in) and search across privileged user-meta columns including user_email.

This vulnerability affects the following application versions:

Advanced Custom Fields (ACF) 5.8.9
Advanced Custom Fields (ACF) 5.8.10
Advanced Custom Fields (ACF) 5.8.11
Advanced Custom Fields (ACF) 5.8.12
Advanced Custom Fields (ACF) 5.8.13
Advanced Custom Fields (ACF) 5.8.14
Advanced Custom Fields (ACF) 5.9.0
Advanced Custom Fields (ACF) 5.9.1
Advanced Custom Fields (ACF) 5.9.2
Advanced Custom Fields (ACF) 5.9.3
Advanced Custom Fields (ACF) 5.9.4
Advanced Custom Fields (ACF) 5.9.5
Advanced Custom Fields (ACF) 5.9.6
Advanced Custom Fields (ACF) 5.9.7
Advanced Custom Fields (ACF) 5.9.8
Advanced Custom Fields (ACF) 5.9.9
Advanced Custom Fields (ACF) 5.10
Advanced Custom Fields (ACF) 5.10.1
Advanced Custom Fields (ACF) 5.10.2
Advanced Custom Fields (ACF) 5.11
Advanced Custom Fields (ACF) 5.11.1
Advanced Custom Fields (ACF) 5.11.2
Advanced Custom Fields (ACF) 5.11.3
Advanced Custom Fields (ACF) 5.11.4
Advanced Custom Fields (ACF) 5.12
Advanced Custom Fields (ACF) 5.12.1
Advanced Custom Fields (ACF) 5.12.2
Advanced Custom Fields (ACF) 5.12.3
Advanced Custom Fields (ACF) 5.12.4
Advanced Custom Fields (ACF) 5.12.5
Advanced Custom Fields (ACF) 5.12.6
Advanced Custom Fields (ACF) 6.0.0
Advanced Custom Fields (ACF) 6.0.1
Advanced Custom Fields (ACF) 6.0.2
Advanced Custom Fields (ACF) 6.0.3
Advanced Custom Fields (ACF) 6.0.4
Advanced Custom Fields (ACF) 6.0.5
Advanced Custom Fields (ACF) 6.0.6
Advanced Custom Fields (ACF) 6.0.7
Advanced Custom Fields (ACF) 6.1.0
Advanced Custom Fields (ACF) 6.1.1
Advanced Custom Fields (ACF) 6.1.2
Advanced Custom Fields (ACF) 6.1.3
Advanced Custom Fields (ACF) 6.1.4
Advanced Custom Fields (ACF) 6.1.5
Advanced Custom Fields (ACF) 6.1.6
Advanced Custom Fields (ACF) 6.1.7
Advanced Custom Fields (ACF) 6.1.8
Advanced Custom Fields (ACF) 6.2.0
Advanced Custom Fields (ACF) 6.2.1
Advanced Custom Fields (ACF) 6.2.2
Advanced Custom Fields (ACF) 6.2.3
Advanced Custom Fields (ACF) 6.2.4
Advanced Custom Fields (ACF) 6.2.5
Advanced Custom Fields (ACF) 6.2.6
Advanced Custom Fields (ACF) 6.2.6.1
Advanced Custom Fields (ACF) 6.2.7
Advanced Custom Fields (ACF) 6.2.8
Advanced Custom Fields (ACF) 6.2.9
Advanced Custom Fields (ACF) 6.3.0
Advanced Custom Fields (ACF) 6.3.1
Advanced Custom Fields (ACF) 6.3.2
Advanced Custom Fields (ACF) 6.3.3
Advanced Custom Fields (ACF) 6.3.4
Advanced Custom Fields (ACF) 6.3.5
Advanced Custom Fields (ACF) 6.3.6
Advanced Custom Fields (ACF) 6.3.6.1
Advanced Custom Fields (ACF) 6.3.6.2
Advanced Custom Fields (ACF) 6.3.6.3
Advanced Custom Fields (ACF) 6.3.9
Advanced Custom Fields (ACF) 6.3.10.2
Advanced Custom Fields (ACF) 6.3.11
Advanced Custom Fields (ACF) 6.3.12
Advanced Custom Fields (ACF) 6.4.0
Advanced Custom Fields (ACF) 6.4.0.1
Advanced Custom Fields (ACF) 6.4.1
Advanced Custom Fields (ACF) 6.4.2
Advanced Custom Fields (ACF) 6.4.3
Advanced Custom Fields (ACF) 6.5.0
Advanced Custom Fields (ACF) 6.5.1
Advanced Custom Fields (ACF) 6.6.0
Advanced Custom Fields (ACF) 6.6.1
Advanced Custom Fields (ACF) 6.6.2
Advanced Custom Fields (ACF) 6.7.0

HTML injection in post titles

Skrevet den 3. februar 2026 af i Advanced Custom Fields (ACF)

The plugin is vulnerable to HTML Injection due to the plugin nor properly neutralizing unsafe HTML. This makes it possible for authenticated attackers, with administrator-level access and above, to inject potentially malicious HTML.

This vulnerability affects the following application versions:

Advanced Custom Fields (ACF) 5.7.3
Advanced Custom Fields (ACF) 5.7.4
Advanced Custom Fields (ACF) 5.7.5
Advanced Custom Fields (ACF) 5.7.6
Advanced Custom Fields (ACF) 5.7.7
Advanced Custom Fields (ACF) 5.7.8
Advanced Custom Fields (ACF) 5.7.9
Advanced Custom Fields (ACF) 5.7.10
Advanced Custom Fields (ACF) 5.7.12
Advanced Custom Fields (ACF) 5.7.13
Advanced Custom Fields (ACF) 5.8.0
Advanced Custom Fields (ACF) 5.8.1
Advanced Custom Fields (ACF) 5.8.2
Advanced Custom Fields (ACF) 5.8.3
Advanced Custom Fields (ACF) 5.8.4
Advanced Custom Fields (ACF) 5.8.5
Advanced Custom Fields (ACF) 5.8.6
Advanced Custom Fields (ACF) 5.8.7
Advanced Custom Fields (ACF) 5.8.8
Advanced Custom Fields (ACF) 5.8.9
Advanced Custom Fields (ACF) 5.8.10
Advanced Custom Fields (ACF) 5.8.11
Advanced Custom Fields (ACF) 5.8.12
Advanced Custom Fields (ACF) 5.8.13
Advanced Custom Fields (ACF) 5.8.14
Advanced Custom Fields (ACF) 5.9.0
Advanced Custom Fields (ACF) 5.9.1
Advanced Custom Fields (ACF) 5.9.2
Advanced Custom Fields (ACF) 5.9.3
Advanced Custom Fields (ACF) 5.9.4
Advanced Custom Fields (ACF) 5.9.5
Advanced Custom Fields (ACF) 5.9.6
Advanced Custom Fields (ACF) 5.9.7
Advanced Custom Fields (ACF) 5.9.8
Advanced Custom Fields (ACF) 5.9.9
Advanced Custom Fields (ACF) 5.10
Advanced Custom Fields (ACF) 5.10.1
Advanced Custom Fields (ACF) 5.10.2
Advanced Custom Fields (ACF) 5.11
Advanced Custom Fields (ACF) 5.11.1
Advanced Custom Fields (ACF) 5.11.2
Advanced Custom Fields (ACF) 5.11.3
Advanced Custom Fields (ACF) 5.11.4
Advanced Custom Fields (ACF) 5.12
Advanced Custom Fields (ACF) 5.12.1
Advanced Custom Fields (ACF) 5.12.2
Advanced Custom Fields (ACF) 5.12.3
Advanced Custom Fields (ACF) 5.12.4
Advanced Custom Fields (ACF) 5.12.5
Advanced Custom Fields (ACF) 5.12.6
Advanced Custom Fields (ACF) 6.0.0
Advanced Custom Fields (ACF) 6.0.1
Advanced Custom Fields (ACF) 6.0.2
Advanced Custom Fields (ACF) 6.0.3
Advanced Custom Fields (ACF) 6.0.4
Advanced Custom Fields (ACF) 6.0.5
Advanced Custom Fields (ACF) 6.0.6
Advanced Custom Fields (ACF) 6.0.7
Advanced Custom Fields (ACF) 6.1.0
Advanced Custom Fields (ACF) 6.1.1
Advanced Custom Fields (ACF) 6.1.2
Advanced Custom Fields (ACF) 6.1.3
Advanced Custom Fields (ACF) 6.1.4
Advanced Custom Fields (ACF) 6.1.5
Advanced Custom Fields (ACF) 6.1.6
Advanced Custom Fields (ACF) 6.1.7
Advanced Custom Fields (ACF) 6.1.8
Advanced Custom Fields (ACF) 6.2.0
Advanced Custom Fields (ACF) 6.2.1
Advanced Custom Fields (ACF) 6.2.2
Advanced Custom Fields (ACF) 6.2.3
Advanced Custom Fields (ACF) 6.2.4
Advanced Custom Fields (ACF) 6.2.5
Advanced Custom Fields (ACF) 6.2.6
Advanced Custom Fields (ACF) 6.2.6.1
Advanced Custom Fields (ACF) 6.2.7
Advanced Custom Fields (ACF) 6.2.8
Advanced Custom Fields (ACF) 6.2.9
Advanced Custom Fields (ACF) 6.3.0
Advanced Custom Fields (ACF) 6.3.1
Advanced Custom Fields (ACF) 6.3.2
Advanced Custom Fields (ACF) 6.3.3
Advanced Custom Fields (ACF) 6.3.4
Advanced Custom Fields (ACF) 6.3.5
Advanced Custom Fields (ACF) 6.3.6
Advanced Custom Fields (ACF) 6.3.6.1
Advanced Custom Fields (ACF) 6.3.6.2
Advanced Custom Fields (ACF) 6.3.6.3
Advanced Custom Fields (ACF) 6.3.9
Advanced Custom Fields (ACF) 6.3.10.2
Advanced Custom Fields (ACF) 6.3.11
Advanced Custom Fields (ACF) 6.3.12
Advanced Custom Fields (ACF) 6.4.0
Advanced Custom Fields (ACF) 6.4.0.1
Advanced Custom Fields (ACF) 6.4.1
Advanced Custom Fields (ACF) 6.4.2

Incorrect permission allows to access ACF shortcodes from private posts

Skrevet den 11. februar 202518. oktober 2025 af i Advanced Custom Fields (ACF)

The ACF shortcode now prevents access to fields from different private posts by default

This vulnerability affects the following application versions:

Advanced Custom Fields (ACF) 5.7.3
Advanced Custom Fields (ACF) 5.7.4
Advanced Custom Fields (ACF) 5.7.5
Advanced Custom Fields (ACF) 5.7.6
Advanced Custom Fields (ACF) 5.7.7
Advanced Custom Fields (ACF) 5.7.8
Advanced Custom Fields (ACF) 5.7.9
Advanced Custom Fields (ACF) 5.7.10
Advanced Custom Fields (ACF) 5.7.12
Advanced Custom Fields (ACF) 5.7.13
Advanced Custom Fields (ACF) 5.8.0
Advanced Custom Fields (ACF) 5.8.1
Advanced Custom Fields (ACF) 5.8.2
Advanced Custom Fields (ACF) 5.8.3
Advanced Custom Fields (ACF) 5.8.4
Advanced Custom Fields (ACF) 5.8.5
Advanced Custom Fields (ACF) 5.8.6
Advanced Custom Fields (ACF) 5.8.7
Advanced Custom Fields (ACF) 5.8.8
Advanced Custom Fields (ACF) 5.8.9
Advanced Custom Fields (ACF) 5.8.10
Advanced Custom Fields (ACF) 5.8.11
Advanced Custom Fields (ACF) 5.8.12
Advanced Custom Fields (ACF) 5.8.13
Advanced Custom Fields (ACF) 5.8.14
Advanced Custom Fields (ACF) 5.9.0
Advanced Custom Fields (ACF) 5.9.1
Advanced Custom Fields (ACF) 5.9.2
Advanced Custom Fields (ACF) 5.9.3
Advanced Custom Fields (ACF) 5.9.4
Advanced Custom Fields (ACF) 5.9.5
Advanced Custom Fields (ACF) 5.9.6
Advanced Custom Fields (ACF) 5.9.7
Advanced Custom Fields (ACF) 5.9.8
Advanced Custom Fields (ACF) 5.9.9
Advanced Custom Fields (ACF) 5.10
Advanced Custom Fields (ACF) 5.10.1
Advanced Custom Fields (ACF) 5.10.2
Advanced Custom Fields (ACF) 5.11
Advanced Custom Fields (ACF) 5.11.1
Advanced Custom Fields (ACF) 5.11.2
Advanced Custom Fields (ACF) 5.11.3
Advanced Custom Fields (ACF) 5.11.4
Advanced Custom Fields (ACF) 5.12
Advanced Custom Fields (ACF) 5.12.1
Advanced Custom Fields (ACF) 5.12.2
Advanced Custom Fields (ACF) 5.12.3
Advanced Custom Fields (ACF) 5.12.4
Advanced Custom Fields (ACF) 5.12.5
Advanced Custom Fields (ACF) 5.12.6
Advanced Custom Fields (ACF) 6.0.0
Advanced Custom Fields (ACF) 6.0.1
Advanced Custom Fields (ACF) 6.0.2
Advanced Custom Fields (ACF) 6.0.3
Advanced Custom Fields (ACF) 6.0.4
Advanced Custom Fields (ACF) 6.0.5
Advanced Custom Fields (ACF) 6.0.6
Advanced Custom Fields (ACF) 6.0.7
Advanced Custom Fields (ACF) 6.1.0
Advanced Custom Fields (ACF) 6.1.1
Advanced Custom Fields (ACF) 6.1.2
Advanced Custom Fields (ACF) 6.1.3
Advanced Custom Fields (ACF) 6.1.4
Advanced Custom Fields (ACF) 6.1.5
Advanced Custom Fields (ACF) 6.1.6
Advanced Custom Fields (ACF) 6.1.7
Advanced Custom Fields (ACF) 6.1.8
Advanced Custom Fields (ACF) 6.2.0
Advanced Custom Fields (ACF) 6.2.1
Advanced Custom Fields (ACF) 6.2.2
Advanced Custom Fields (ACF) 6.2.3
Advanced Custom Fields (ACF) 6.2.4
Advanced Custom Fields (ACF) 6.2.5
Advanced Custom Fields (ACF) 6.2.6
Advanced Custom Fields (ACF) 6.2.6.1
Advanced Custom Fields (ACF) 6.2.7
Advanced Custom Fields (ACF) 6.2.8
Advanced Custom Fields (ACF) 6.2.9
Advanced Custom Fields (ACF) 6.3.0
Advanced Custom Fields (ACF) 6.3.1
Advanced Custom Fields (ACF) 6.3.2
Advanced Custom Fields (ACF) 6.3.3

SQL Injection in legacy field output

Skrevet den 21. januar 202518. oktober 2025 af i Advanced Custom Fields (ACF)

Deprecated a legacy private internal field type (output) to prevent it being able to output unsafe HTML

This vulnerability affects the following application versions:

Advanced Custom Fields (ACF) 5.6.2
Advanced Custom Fields (ACF) 5.6.3
Advanced Custom Fields (ACF) 5.6.4
Advanced Custom Fields (ACF) 5.6.5
Advanced Custom Fields (ACF) 5.6.6
Advanced Custom Fields (ACF) 5.6.7
Advanced Custom Fields (ACF) 5.6.8
Advanced Custom Fields (ACF) 5.6.9
Advanced Custom Fields (ACF) 5.6.10
Advanced Custom Fields (ACF) 5.7.0
Advanced Custom Fields (ACF) 5.7.1
Advanced Custom Fields (ACF) 5.7.2
Advanced Custom Fields (ACF) 5.7.3
Advanced Custom Fields (ACF) 5.7.4
Advanced Custom Fields (ACF) 5.7.5
Advanced Custom Fields (ACF) 5.7.6
Advanced Custom Fields (ACF) 5.7.7
Advanced Custom Fields (ACF) 5.7.8
Advanced Custom Fields (ACF) 5.7.9
Advanced Custom Fields (ACF) 5.7.10
Advanced Custom Fields (ACF) 5.7.12
Advanced Custom Fields (ACF) 5.7.13
Advanced Custom Fields (ACF) 5.8.0
Advanced Custom Fields (ACF) 5.8.1
Advanced Custom Fields (ACF) 5.8.2
Advanced Custom Fields (ACF) 5.8.3
Advanced Custom Fields (ACF) 5.8.4
Advanced Custom Fields (ACF) 5.8.5
Advanced Custom Fields (ACF) 5.8.6
Advanced Custom Fields (ACF) 5.8.7
Advanced Custom Fields (ACF) 5.8.8
Advanced Custom Fields (ACF) 5.8.9
Advanced Custom Fields (ACF) 5.8.10
Advanced Custom Fields (ACF) 5.8.11
Advanced Custom Fields (ACF) 5.8.12
Advanced Custom Fields (ACF) 5.8.13
Advanced Custom Fields (ACF) 5.8.14
Advanced Custom Fields (ACF) 5.9.0
Advanced Custom Fields (ACF) 5.9.1
Advanced Custom Fields (ACF) 5.9.2
Advanced Custom Fields (ACF) 5.9.3
Advanced Custom Fields (ACF) 5.9.4
Advanced Custom Fields (ACF) 5.9.5
Advanced Custom Fields (ACF) 5.9.6
Advanced Custom Fields (ACF) 5.9.7
Advanced Custom Fields (ACF) 5.9.8
Advanced Custom Fields (ACF) 5.9.9
Advanced Custom Fields (ACF) 5.10
Advanced Custom Fields (ACF) 5.10.1
Advanced Custom Fields (ACF) 5.10.2
Advanced Custom Fields (ACF) 5.11
Advanced Custom Fields (ACF) 5.11.1
Advanced Custom Fields (ACF) 5.11.2
Advanced Custom Fields (ACF) 5.11.3
Advanced Custom Fields (ACF) 5.11.4
Advanced Custom Fields (ACF) 5.12
Advanced Custom Fields (ACF) 5.12.1
Advanced Custom Fields (ACF) 5.12.2
Advanced Custom Fields (ACF) 5.12.3
Advanced Custom Fields (ACF) 5.12.4
Advanced Custom Fields (ACF) 5.12.5
Advanced Custom Fields (ACF) 5.12.6
Advanced Custom Fields (ACF) 6.0.0
Advanced Custom Fields (ACF) 6.0.1
Advanced Custom Fields (ACF) 6.0.2
Advanced Custom Fields (ACF) 6.0.3
Advanced Custom Fields (ACF) 6.0.4
Advanced Custom Fields (ACF) 6.0.5
Advanced Custom Fields (ACF) 6.0.6
Advanced Custom Fields (ACF) 6.0.7
Advanced Custom Fields (ACF) 6.1.0
Advanced Custom Fields (ACF) 6.1.1
Advanced Custom Fields (ACF) 6.1.2
Advanced Custom Fields (ACF) 6.1.3
Advanced Custom Fields (ACF) 6.1.4
Advanced Custom Fields (ACF) 6.1.5
Advanced Custom Fields (ACF) 6.1.6
Advanced Custom Fields (ACF) 6.1.7
Advanced Custom Fields (ACF) 6.1.8
Advanced Custom Fields (ACF) 6.2.0
Advanced Custom Fields (ACF) 6.2.1
Advanced Custom Fields (ACF) 6.2.2
Advanced Custom Fields (ACF) 6.2.3
Advanced Custom Fields (ACF) 6.2.4
Advanced Custom Fields (ACF) 6.2.5
Advanced Custom Fields (ACF) 6.2.6
Advanced Custom Fields (ACF) 6.2.6.1
Advanced Custom Fields (ACF) 6.2.7
Advanced Custom Fields (ACF) 6.2.8
Advanced Custom Fields (ACF) 6.2.9
Advanced Custom Fields (ACF) 6.3.0
Advanced Custom Fields (ACF) 6.3.1

Preventing subscribers from performing editor only actions

Skrevet den 10. december 202418. oktober 2025 af i Advanced Custom Fields (ACF)

Certain editor only actions’ permissions are not correctly verified against subscribers performing those actions.

This vulnerability affects the following application versions:

Advanced Custom Fields (ACF) 5.8.1
Advanced Custom Fields (ACF) 5.8.2
Advanced Custom Fields (ACF) 5.8.3
Advanced Custom Fields (ACF) 5.8.4
Advanced Custom Fields (ACF) 5.8.5
Advanced Custom Fields (ACF) 5.8.6
Advanced Custom Fields (ACF) 5.8.7
Advanced Custom Fields (ACF) 5.8.8
Advanced Custom Fields (ACF) 5.8.9
Advanced Custom Fields (ACF) 5.8.10
Advanced Custom Fields (ACF) 5.8.11
Advanced Custom Fields (ACF) 5.8.12
Advanced Custom Fields (ACF) 5.8.13
Advanced Custom Fields (ACF) 5.8.14
Advanced Custom Fields (ACF) 5.9.0
Advanced Custom Fields (ACF) 5.9.1
Advanced Custom Fields (ACF) 5.9.2
Advanced Custom Fields (ACF) 5.9.3
Advanced Custom Fields (ACF) 5.9.4
Advanced Custom Fields (ACF) 5.9.5
Advanced Custom Fields (ACF) 5.9.6
Advanced Custom Fields (ACF) 5.9.7
Advanced Custom Fields (ACF) 5.9.8
Advanced Custom Fields (ACF) 5.9.9
Advanced Custom Fields (ACF) 5.10
Advanced Custom Fields (ACF) 5.10.1
Advanced Custom Fields (ACF) 5.10.2
Advanced Custom Fields (ACF) 5.11
Advanced Custom Fields (ACF) 5.11.1
Advanced Custom Fields (ACF) 5.11.2
Advanced Custom Fields (ACF) 5.11.3
Advanced Custom Fields (ACF) 5.11.4
Advanced Custom Fields (ACF) 5.12
Advanced Custom Fields (ACF) 5.12.1
Advanced Custom Fields (ACF) 5.12.2
Advanced Custom Fields (ACF) 5.12.3
Advanced Custom Fields (ACF) 5.12.4
Advanced Custom Fields (ACF) 5.12.5
Advanced Custom Fields (ACF) 5.12.6
Advanced Custom Fields (ACF) 6.0.0
Advanced Custom Fields (ACF) 6.0.1
Advanced Custom Fields (ACF) 6.0.2
Advanced Custom Fields (ACF) 6.0.3
Advanced Custom Fields (ACF) 6.0.4
Advanced Custom Fields (ACF) 6.0.5
Advanced Custom Fields (ACF) 6.0.6
Advanced Custom Fields (ACF) 6.0.7
Advanced Custom Fields (ACF) 6.1.0
Advanced Custom Fields (ACF) 6.1.1
Advanced Custom Fields (ACF) 6.1.2
Advanced Custom Fields (ACF) 6.1.3
Advanced Custom Fields (ACF) 6.1.4
Advanced Custom Fields (ACF) 6.1.5
Advanced Custom Fields (ACF) 6.1.6
Advanced Custom Fields (ACF) 6.1.7
Advanced Custom Fields (ACF) 6.1.8
Advanced Custom Fields (ACF) 6.2.0
Advanced Custom Fields (ACF) 6.2.1
Advanced Custom Fields (ACF) 6.2.2
Advanced Custom Fields (ACF) 6.2.3
Advanced Custom Fields (ACF) 6.2.4
Advanced Custom Fields (ACF) 6.2.5
Advanced Custom Fields (ACF) 6.2.6
Advanced Custom Fields (ACF) 6.2.6.1
Advanced Custom Fields (ACF) 6.2.7
Advanced Custom Fields (ACF) 6.2.8
Advanced Custom Fields (ACF) 6.2.9
Advanced Custom Fields (ACF) 6.3.0
Advanced Custom Fields (ACF) 6.3.1

Authenticated (Admin+) Limited Arbitrary Function Call

Skrevet den 10. december 202411. juni 2025 af i Advanced Custom Fields (ACF)

Post Type and Taxonomy metabox callbacks no longer have access to any superglobal values such as $_POST, $_REQUEST.

Due to insufficient input validation via the ‘register_meta_box_cb’ and ‘meta_box_cb’ parameters parameters, makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary functions, like WordPress functions, in custom post types that will execute whenever a user accesses the injected post type. This can be leveraged to trick other users like administrators accessing posts into performing unauthorized actions through functions, and is not a very serious risk for the vast majority of site owners. Please follow the reference listed in this vulnerability record for instructions on how to update to the latest version of ACF that patches this issue and ensures accessibility to updates moving forward.

This vulnerability affects the following application versions:

Advanced Custom Fields (ACF) 6.1.0
Advanced Custom Fields (ACF) 6.1.1
Advanced Custom Fields (ACF) 6.1.2
Advanced Custom Fields (ACF) 6.1.3
Advanced Custom Fields (ACF) 6.1.4
Advanced Custom Fields (ACF) 6.1.5
Advanced Custom Fields (ACF) 6.1.6
Advanced Custom Fields (ACF) 6.1.7
Advanced Custom Fields (ACF) 6.1.8
Advanced Custom Fields (ACF) 6.2.0
Advanced Custom Fields (ACF) 6.2.1
Advanced Custom Fields (ACF) 6.2.2
Advanced Custom Fields (ACF) 6.2.3
Advanced Custom Fields (ACF) 6.2.4
Advanced Custom Fields (ACF) 6.2.5
Advanced Custom Fields (ACF) 6.2.6
Advanced Custom Fields (ACF) 6.2.6.1
Advanced Custom Fields (ACF) 6.2.7
Advanced Custom Fields (ACF) 6.2.8
Advanced Custom Fields (ACF) 6.2.9
Advanced Custom Fields (ACF) 6.3.0
Advanced Custom Fields (ACF) 6.3.1
Advanced Custom Fields (ACF) 6.3.2
Advanced Custom Fields (ACF) 6.3.3
Advanced Custom Fields (ACF) 6.3.4
Advanced Custom Fields (ACF) 6.3.5
Advanced Custom Fields (ACF) 6.3.6
Advanced Custom Fields (ACF) 6.3.6.1
Advanced Custom Fields (ACF) 6.3.6.2

Incorrect permissions when accessing posts using ACF shortcode

Skrevet den 10. december 202418. oktober 2025 af i Advanced Custom Fields (ACF)

Current implementation allows the acf shortcode to access different fields in posts that are not public when you access it form a different post.

This vulnerability affects the following application versions:

Advanced Custom Fields (ACF) 6.0.3
Advanced Custom Fields (ACF) 6.0.4
Advanced Custom Fields (ACF) 6.0.5
Advanced Custom Fields (ACF) 6.0.6
Advanced Custom Fields (ACF) 6.0.7
Advanced Custom Fields (ACF) 6.1.0
Advanced Custom Fields (ACF) 6.1.1
Advanced Custom Fields (ACF) 6.1.2
Advanced Custom Fields (ACF) 6.1.3
Advanced Custom Fields (ACF) 6.1.4
Advanced Custom Fields (ACF) 6.1.5
Advanced Custom Fields (ACF) 6.1.6
Advanced Custom Fields (ACF) 6.1.7
Advanced Custom Fields (ACF) 6.1.8
Advanced Custom Fields (ACF) 6.2.0
Advanced Custom Fields (ACF) 6.2.1
Advanced Custom Fields (ACF) 6.2.2
Advanced Custom Fields (ACF) 6.2.3
Advanced Custom Fields (ACF) 6.2.4
Advanced Custom Fields (ACF) 6.2.5
Advanced Custom Fields (ACF) 6.2.6
Advanced Custom Fields (ACF) 6.2.6.1
Advanced Custom Fields (ACF) 6.2.7
Advanced Custom Fields (ACF) 6.2.8
Advanced Custom Fields (ACF) 6.2.9
Advanced Custom Fields (ACF) 6.3.0
Advanced Custom Fields (ACF) 6.3.1
Advanced Custom Fields (ACF) 6.3.2
Advanced Custom Fields (ACF) 6.3.3

Escaping field labels

Skrevet den 10. december 2024 af i Advanced Custom Fields (ACF)

Field labels are now correctly escaped when rendered in the Field Group editor, to prevent a potential XSS issue.

This vulnerability affects the following application versions:

Advanced Custom Fields (ACF) 6.3.4
Advanced Custom Fields (ACF) 6.3.5

XSS in tooltip of advanced custom field

Skrevet den 25. november 202418. oktober 2025 af i Advanced Custom Fields (ACF)

The instruction for the helper/tooltip are not properly escaped to prevent an XSS attack.

This vulnerability affects the following application versions:

Advanced Custom Fields (ACF) 6.0.0
Advanced Custom Fields (ACF) 6.0.1
Advanced Custom Fields (ACF) 6.0.2
Advanced Custom Fields (ACF) 6.0.3
Advanced Custom Fields (ACF) 6.0.4
Advanced Custom Fields (ACF) 6.0.5
Advanced Custom Fields (ACF) 6.0.6
Advanced Custom Fields (ACF) 6.0.7
Advanced Custom Fields (ACF) 6.1.0
Advanced Custom Fields (ACF) 6.1.1
Advanced Custom Fields (ACF) 6.1.2
Advanced Custom Fields (ACF) 6.1.3
Advanced Custom Fields (ACF) 6.1.4
Advanced Custom Fields (ACF) 6.1.5
Advanced Custom Fields (ACF) 6.1.6
Advanced Custom Fields (ACF) 6.1.7
Advanced Custom Fields (ACF) 6.1.8
Advanced Custom Fields (ACF) 6.2.0
Advanced Custom Fields (ACF) 6.2.1
Advanced Custom Fields (ACF) 6.2.2
Advanced Custom Fields (ACF) 6.2.3
Advanced Custom Fields (ACF) 6.2.4
Advanced Custom Fields (ACF) 6.2.5
Advanced Custom Fields (ACF) 6.2.6
Advanced Custom Fields (ACF) 6.2.6.1
Advanced Custom Fields (ACF) 6.2.7
Advanced Custom Fields (ACF) 6.2.8
Advanced Custom Fields (ACF) 6.2.9
Advanced Custom Fields (ACF) 6.3.0
Advanced Custom Fields (ACF) 6.3.1

Om os

Standoutmedia er et webbureau dedikeret til WordPress platformen.
Vi driver egne hostingløsninger, hvor tusindvis af kunder hver dag modtager sikkerhedsopdateringer.

Læs mere om os her: https://standoutmedia.dk/