Wpengine INC vulnerabilities
7 vulnerabilities
Known vulnerabilities in Wpengine INC products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
Products
3- Advanced Custom Fields PRO5 vulnerabilities
- Advanced Custom Fields1 vulnerabilities
- WP Migrate1 vulnerabilities
CVE-2025-54940wordpressadvanced-custom-fields+1
EPSS score0.21%
An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered.CVE-2024-37249wordpressadvanced-custom-fields-pro+1EPSS score0.32%
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.CVE-2024-37250wordpressadvanced-custom-fields-pro+1EPSS score0.30%
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.CVE-2024-37251wordpressadvanced-custom-fields-pro+1EPSS score0.23%
Cross-Site Request Forgery (CSRF) vulnerability in WPENGINE, INC. Advanced Custom Fields PRO.This issue affects Advanced Custom Fields PRO: from n/a before 6.3.2.CVE-2024-30225wordpresswp-migrate-db-pro+1EPSS score0.68%
Deserialization of Untrusted Data vulnerability in WPENGINE, INC. WP Migrate.This issue affects WP Migrate: from n/a through 2.6.10.CVE-2024-34762wordpressadvanced-custom-fields-pro+1EPSS score0.59%
Vulnerability discovered by executing a planned security audit.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10.CVE-2024-34761wordpressadvanced-custom-fields-pro+1EPSS score0.43%
Vulnerability discovered by executing a planned security audit.
Improper Control of Generation of Code ('Code Injection') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows Code Injection.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10.