Secure Custom Fields ![rw-book-cover](https://wpscan.com/wp-content/uploads/2023/08/cropped-83c25-favicon.png) ## Metadata - Author: [[WPScan]] - Full Title: Secure Custom Fields - Category: #articles - Summary: Discover the latest security vulnerabilities affecting Secure Custom Fields. With WPScan, protect your WordPress site from Secure Custom Fields plugin exploits. - URL: https://wpscan.com/plugin/advanced-custom-fields/ Vulnerabilities: 12 Last Updated: Active Installs: 2000000 Published Title Fixed in CVSS 2024-05-30 [Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access](https://a8cteam5105.wordpress.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/) Fixed in 6.3 2.7 (low) 2024-01-17 [Advanced Custom Fields < 6.2.5 - Contributor+ Stored Cross-Site Scripting via Custom Field](https://a8cteam5105.wordpress.com/vulnerability/9a536e07-6e99-45c1-9233-f7cee5c29ea4/) Fixed in 6.2.5 6.4 (medium) 2023-05-04 [Advanced Custom Fields < 6.1.6 - Reflected XSS](https://a8cteam5105.wordpress.com/vulnerability/95ded80f-a47b-411e-bd17-050439bf565f/) Fixed in 6.1.6 7.1 (high) 2023-04-10 [Advanced Custom Fields < 6.1.0 - Contributor+ PHP Object Injection](https://a8cteam5105.wordpress.com/vulnerability/8e5ec88e-0e66-44e4-bbf2-74155d849ede/) Fixed in 6.1.0 6.6 (medium) 2023-04-10 [Advanced Custom Fields < 5.12.5 - Contributor+ PHP Object Injection](https://a8cteam5105.wordpress.com/vulnerability/cf376ca2-92f6-44ff-929a-ace809460a33/) Fixed in 5.12.5 6.6 (medium) 2022-08-01 [Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload](https://a8cteam5105.wordpress.com/vulnerability/3fde5336-552c-4861-8b4d-89a16735c0e2/) Fixed in 5.12.3 5.3 (medium) 2022-03-30 [Advanced Custom Fields < 5.12.1 - Contributor+ Database Information Access](https://a8cteam5105.wordpress.com/vulnerability/413576a8-0f20-465e-80cf-7cb0cb22bded/) Fixed in 5.12.1 6.5 (medium) 2021-08-25 [Advanced Custom Fields < 5.11 - Subscriber+ Arbitrary ACF Data/Field Groups View and Fields Move](https://a8cteam5105.wordpress.com/vulnerability/f322619a-e85d-4931-8785-eb9cf30cef7f/) Fixed in 5.11 4.3 (medium) 2021-01-06 [Advanced Custom Fields < 5.8.12 - Cross-Site Scripting in Select2 dropdowns](https://a8cteam5105.wordpress.com/vulnerability/daa26c20-4295-40a3-b06f-62b22a635083/) Fixed in 5.8.12 4.4 (medium) 2019-02-15 [Advanced Custom Fields < 5.7.12 - Unserialize of user input](https://a8cteam5105.wordpress.com/vulnerability/14d0223a-4aca-4069-82f2-ba22e354daad/) Fixed in 5.7.12 n/a 2018-12-07 [Advanced Custom Fields <= 5.7.7 - Authenticated Cross-Site Scripting (XSS)](https://a8cteam5105.wordpress.com/vulnerability/a90020b3-1d8f-4278-93f4-a3263e3bbdcd/) Fixed in 5.7.8, Secure Custom Fields, WPScan, 01jaasf546qtqxpztcftvk0d90.