ACF Extended vulnerabilities

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended acf-extended allows Stored XSS. This issue affects ACF Extended: from n/a through 0.9.2.7.

The ACF Extended WordPress plugin (versions through 0.9.2.7) contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of improperly configured access controls.

The ACF Extended plugin through 0.9.2.7 contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. This may allow an attacker to access files outside the intended directory.

The ACF Extended plugin in versions 0.9.2.6 and earlier has a Broken Access Control vulnerability for contributors. Contributor-level users can gain unauthorized access to administrative functions.