Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2012-10025

WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File Inclusion

The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server’s context, allowing full compromise of the host.

CVSS 4.0 · 10 Critical EPSS 2.1% KEV · Not listed
Vendors
Accesspressthemes Advanced Custom Fields Wordpress
Products
Frontend Post Wordpress Plugin Advanced Custom Fields Wordpress Plugin Wordpress
CVE-2022-4946

Frontend Post WordPress Plugin <= 2.8.4 - Contributor+ Arbitrary Redirect

The Frontend Post WordPress Plugin WordPress plugin through 2.8.4 does not validate an attribute of one of its shortcode, which could allow users with a role as low as contributor to add a malicious shortcode to a page/post, which will redirect users to an arbitrary domain.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Accesspressthemes
Products
Frontend Post Wordpress Plugin