WP Engine vulnerabilities

CVEs per yearBy the year they were published

1. 20233
2. 20242
3. 20251
4. 20262

Newest CVEs

• CVE-2026-49043

  WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability

  WP Engine · WP Migrate Lite

  Medium4.7
• CVE-2026-49062

  WordPress Faust.js plugin <= 1.8.7 - Broken Authentication vulnerability

  WP Engine · Faust.js

  High8.8
• CVE-2025-50041

  WordPress Gutenberg Blocks – ACF Blocks Suite plugin <= 2.6.11 - Cross Site Scripting (XSS) Vulnerability

  WP Engine · Gutenberg Blocks – ACF Blocks Suite

  Medium6.5
• CVE-2024-45429

  Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an…

  WP Engine · Advanced Custom Fields

  Medium6.1
• CVE-2022-40696

  WordPress Advanced Custom Fields Plugin 3.1.1-6.0.2 is vulnerable to Sensitive Data Exposure

  WP Engine · Advanced Custom Fields (ACF)

  Low3.7
• CVE-2023-40068

  Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote…

  WP Engine · Advanced Custom Fields

  Medium5.4
• CVE-2023-24421

  WordPress PHP Compatibility Checker Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

  WP Engine · PHP Compatibility Checker

  Medium5.4
• CVE-2023-30777

  WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)

  WP Engine · Advanced Custom Fields Pro

  High7.1