CVE-2025-15463mediumCWE-94

CVE-2025-15463: falha de média gravidade em hwk-fr Advanced Custom Fields: Extended

Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Advanced Custom Fields: Extended

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
hwk-fr · Advanced Custom Fields: Extended
CVEs relacionadas — hwk-fr Advanced Custom Fields: Extended

No mesmo produto, das mais perigosas para as menos.

CVE-2025-13486CRITICALAdvanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_formEPSS 68.6%CVE-2025-14533CRITICALAdvanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form ActionEPSS 1.5%CVE-2026-8809CRITICALAdvanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' ParameterEPSS 0.8%CVE-2026-110305HIGHAdvanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag InjectionEPSS 0.6%CVE-2023-5292MEDIUMAdvanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2026-2839MEDIUMAdvanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX EndpointsEPSS 0.3%