Simple Fields Vulnerabilities

The Simple Fields plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 0.3.5. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access contro...

CVSS:

8.1

Affected:

up to 0.3.5

Fix:

No patched version reported

Disclosed:

May 17, 2026

CVE-2018-25324 on NVD →

The Simple Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maybe_do_import() function in versions up to, and including, 1.4.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w...

CVSS:

7.2

Affected:

up to 1.4.11

Fix:

No patched version reported

Disclosed:

Sep 24, 2019

The simple-fields plugin before 1.4.11 for WordPress has XSS.

CVSS:

6.1

Affected:

up to 1.4.11

Fixed in:

1.4.11

Disclosed:

Aug 25, 2015

CVE-2015-9302 on NVD →

The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.

CVSS:

8.8

Affected:

up to 1.2

Fixed in:

1.2

Disclosed:

Apr 1, 2013

CVE-2013-7476 on NVD →