| CVE-2026-97189 |
Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields
|
2.7
Low
|
Nov 7, 2026 |
| CVE-2026-97190 |
Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR
|
2.7
Low
|
Nov 7, 2026 |
| CVE-2026-97191 |
Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path
|
2.7
Low
|
Nov 7, 2026 |
| CVE-2026-110813 |
Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection
|
7.5
High
|
Nov 6, 2026 |