WordPress plugin

WC Fields Factory security & vulnerabilities

Q: Is any WC Fields Factory vulnerability listed in CISA KEV?

No. None of the known WC Fields Factory vulnerabilities is currently listed in the CISA KEV catalog.

wc-fields-factory— active installsLast vulnerability Oct 5, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin

5Known vulnerabilities

Critical0
High2
Medium3
Low0

Vulnerabilities per year

All WC Fields Factory vulnerabilities

WC Fields Factory vulnerabilities
Severity	Vulnerability	CVE	Published
Medium6.4	Authenticated (Subscriber+) Stored Cross-Site Scripting ≤4.1.12No patch available	CVE-2026-39727	Oct 05
Medium4.3	Missing Authorization ≤4.1.10Update to 4.1.11	CVE-2026-93508	Sep 21
Medium4.3	Missing Authorization ≤4.1.10Update to 4.1.11	CVE-2026-93507	Sep 21
High8.8	Authenticated(Subscriber+) SQL Injection ≤4.1.5Update to 4.1.6	—	Mar 28, 2023
High7.2	Authenticated (Administrator+) SQL Injection ≤4.1.5Update to 4.1.6	CVE-2023-0277	Mar 27, 2023

Medium6.4
Authenticated (Subscriber+) Stored Cross-Site Scripting
≤4.1.12No patch available
CVE-2026-39727Oct 05
Medium4.3
Missing Authorization
≤4.1.10Update to 4.1.11
CVE-2026-93508Sep 21
Medium4.3
Missing Authorization
≤4.1.10Update to 4.1.11
CVE-2026-93507Sep 21
High8.8
Authenticated(Subscriber+) SQL Injection
≤4.1.5Update to 4.1.6
5c51f55f-6e8c-467c-999b-4e6a1a6f7bbcMar 28, 2023
High7.2
Authenticated (Administrator+) SQL Injection
≤4.1.5Update to 4.1.6
CVE-2023-0277Mar 27, 2023

WC Fields Factory: common questions

Does WC Fields Factory have known vulnerabilities?

Yes. VulnCrest Radar lists 5 known vulnerabilities in WC Fields Factory: 2 high, 3 medium. At least one is not fixed in the latest version.

How do I check which version of WC Fields Factory I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent WC Fields Factory vulnerability?

CVE-2026-39727, published Oct 5, 2026: WC Fields Factory <= 4.1.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any WC Fields Factory vulnerability listed in CISA KEV?

No. None of the known WC Fields Factory vulnerabilities is currently listed in the CISA KEV catalog.