PT-2025-32344 · WordPress · Advanced Custom Fields Pro

Shogo Kumamaru · Published 2025-08-08 · Updated 2025-08-08 · CVE-2025-54940

Positive Technologies (AI Summary)

CVSS v3.1

3.4

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields versions prior to 6.4.3

Description An HTML injection issue exists in the Advanced Custom Fields plugin. Exploitation of this issue may allow crafted HTML code to be rendered, potentially tampering with page display.

Recommendations Update Advanced Custom Fields to version 6.4.3 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-54940

Affected Products

Advanced Custom Fields Pro

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-54940 · Security Note
• https://t.me/CVEtracker/29495 · Telegram Post
• https://advancedcustomfields.com/blog/acf-6-4-3-security-release · Note
• https://t.me/cveNotify/131378 · Telegram Post
• https://twitter.com/CVEnew/status/1953689819172733440 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1953723682506916050 · Twitter Post
• https://jvn.jp/en/jp/JVN21048820 · Note