ACF Extended has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 7.1 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-112312High· 7.5WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability41CVE-2026-112313High· 7.1WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability39CVE-2026-112311Medium· 6.5WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability36
ACF Extended vulnerabilities
CVEs affecting ACF Extended, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-112313High· 7.1WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7.
CVE-2026-112312High· 7.5WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.
CVE-2026-112311Medium· 6.5WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7.