WP Engine vulnerabilities
8 vulnerabilities
Known vulnerabilities in WP Engine products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 7 products.
Products
7- Advanced Custom Fields3 vulnerabilities
- Advanced Custom Fields Pro3 vulnerabilities
- Advanced Custom Fields (Acf)1 vulnerabilities
- Faust.Js1 vulnerabilities
- Gutenberg Blocks – ACF Blocks Suite1 vulnerabilities
- PHP Compatibility Checker1 vulnerabilities
- WP Migrate Lite1 vulnerabilities
CVE-2025-50041wordpressacf-blocks+1
EPSS score0.23%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Engine Gutenberg Blocks – ACF Blocks Suite acf-blocks allows Stored XSS.This issue affects Gutenberg Blocks – ACF Blocks Suite: from n/a through <= 2.6.11.CVE-2022-40696advancedcustomfieldsadvanced_custom_fields+2EPSS score0.52%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.CVE-2024-45429wordpressadvanced-custom-fields+4EPSS score0.42%
Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker's.CVE-2026-49062wordpressfaustwp+1EPSS score0.56%
Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation.
This issue affects Faust.Js: from n/a through 1.8.7.CVE-2026-49043wordpresswp-migrate-db+1EPSS score0.16%
Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions.CVE-2023-40068advancedcustomfieldsadvanced_custom_fields+3EPSS score1.97%
Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.CVE-2023-24421wordpressphp-compatibility-checker+2EPSS score0.27%
Cross-Site Request Forgery (CSRF) vulnerability in WP Engine PHP Compatibility Checker plugin <= 1.5.2 versions.CVE-2023-30777advancedcustomfieldsadvanced_custom_fields+4EPSS score39.00%
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.