Hhwk-fr

Products

Exploited and recent CVEs

• CVE-2026-110305 High 7.5 Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection 0.6%
• CVE-2026-2839 Medium 5.3 Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints 0.3%
• CVE-2026-10752 Medium 4.8 Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field 0.3%
• CVE-2026-8809 Critical 9.8 Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter 0.8%
• CVE-2025-15463 Medium 6.5 Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution 0.4%
• CVE-2025-12037 Medium 4.4 WP 404 Auto Redirect <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting 0.2%
• CVE-2025-14533 Critical 9.8 Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action 1.5%
• CVE-2025-13486 Critical 9.8 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form 68.6%
• CVE-2024-32559 High 7.1 WordPress WP 404 Auto Redirect to Similar Post plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability 0.4%
• CVE-2024-0509 Medium 6.1 WP 404 Auto Redirect to Similar Post <= 1.0.3 - Reflected Cross-Site Scripting via request 1.2%
• CVE-2023-5292 Medium 6.4 Advanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.4%
• CVE-2023-40206 Medium 5.9 WordPress WP 404 Auto Redirect to Similar Post Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS) 0.4%