Wpengine
10 CVEs across 10 Wpengine products. Browse Wpengine vulnerabilities, severities, and proof-of-concept exploits.
Wpengine products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8382 | Medium | 5.3 | 2026-05-31 | The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the pl… |
CVE-2026-4031 | High | 7.5 | 2026-05-14 | The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the pl… |
CVE-2026-4030 | High | 8.1 | 2026-05-14 | The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5… |
CVE-2026-4029 | High | 7.5 | 2026-05-14 | The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2. This is due t… |
CVE-2026-4812 | Medium | 5.3 | 2026-04-15 | The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including… |
CVE-2025-11427 | Medium | 5.8 | 2025-11-18 | The WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and includin… |
CVE-2024-3901 | Medium | 6.8 | 2025-05-15 | The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allow… |
CVE-2022-4974 | Medium | 6.3 | 2024-10-16 | The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to… |
CVE-2024-45429 | Medium | 6.1 | 2024-09-04 | Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an… |
CVE-2024-3563 | Medium | 6.4 | 2024-07-09 | The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sharing block in all versions up to, and including, 3.1.3… |
CVE-2024-2761 | Medium | 6.8 | 2024-04-19 | The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at least contributor p… |
CVE-2023-6933 | High | 8.8 | 2024-02-05 | The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrust… |
CVE-2023-6701 | Medium | 6.4 | 2024-02-05 | The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including… |
CVE-2022-1563 | Medium | 5.3 | 2024-01-16 | The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via Graph… |
CVE-2023-23684 | Medium | 4.4 | 2023-11-13 | Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5. |
CVE-2023-24421 | Medium | 5.4 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in WP Engine PHP Compatibility Checker plugin <= 1.5.2 versions. |
CVE-2019-9881 | Medium | 5.3 | 2019-06-10 | The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment'… |
CVE-2019-9880 | Critical | 9.1 | 2019-06-10 | An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to ret… |
CVE-2019-9879 | Critical | 9.8 | 2019-06-10 | The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. Thi… |