PLUGIN SECURITY
Is Advanced Custom Fields Font Awesome safe?
Adds a new 'Font Awesome Icon' field to the popular Advanced Custom Fields plugin.
What this plugin does
- Slug:
advanced-custom-fields-font-awesome - Author: Justin Kruit
- 90000+ active installs
- 98/100 rating (36 reviews on wordpress.org)
- 2001769 all-time downloads
- On WordPress.org since 2014-02-18
acfadvanced custom fieldsFont AwesomeFontAwesome
Maintenance status
- Latest known version: 6.1.2
- Last updated: 2026-08-14 9:14am GMT
- Tested up to WordPress: 7.1
- Requires PHP: 5.6+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
4 known CVEs on file for Advanced Custom Fields Font Awesome. Reported between 2026 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-66678 | Advanced Custom Fields: Font Awesome Field [advanced-custom-fields-font-awesome] < 6.1.3 | Missing Authorization | Medium 4.3 | < 6.1.3 | 6.1.3 | 2026-08-06 | ⚠ update needed |
| CVE-2026-49044 | Advanced Custom Fields: Font Awesome Field [advanced-custom-fields-font-awesome] < 6.0.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 6.0.0 | 6.0.0 | 2026-05-27 | ✓ fixed in latest |
| CVE-2026-6415 | Advanced Custom Fields: Font Awesome Field [advanced-custom-fields-font-awesome] < 6.0.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 6.0.0 | 6.0.0 | 2026-05-14 | ✓ fixed in latest |
| CVE-2025-14983 | Advanced Custom Fields: Font Awesome Field [advanced-custom-fields-font-awesome] < 5.0.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 5.0.2 | 5.0.2 | 2026-02-18 | ✓ fixed in latest |
How to fix it
Keep Advanced Custom Fields Font Awesome updated — 6.1.2 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Advanced Custom Fields (ACF®) — 2000000+ active installs — 90/100 (1437) — max PHP 8.4
- ACF Content Analysis for Yoast SEO — 100000+ active installs — 82/100 (35) — max PHP 8.4
- Advanced Custom Fields: Extended — 100000+ active installs — 96/100 (132) — max PHP <8.0
- ACF Photo Gallery Field — 60000+ active installs — 80/100 (29)
- Table Field Add-on for ACF and SCF — 50000+ active installs — 98/100 (59) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.