CVE-2025-54940

An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered.

We have discovered 4,433 live websites that are affected by CVE-2025-54940.

Run a Free Instant Scan



Affected Software

Product  Advanced Custom Fields
Category Wordpress Plugins
Vulnerable Domains4,433 live websites (50% of Advanced Custom Fields install base)
Vulnerable Versions
  • from 0 through 6.4.3
Vulnerable Versions Count113 versions ( 86% of all versions)



Details

  • Published - Aug 8, 2025
  • Updated - Aug 8, 2025

Website Distribution by Country

Number of websites using CVE-2025-54940
United States1,302 websites


France371 websites
Germany358 websites
GB338 websites
Russia229 websites
Canada137 websites
Netherlands136 websites
Italy129 websites
Spain100 websites
Switzerland97 websites

Website Distribution by TLD

Number of websites using CVE-2025-54940
.com1,689 websites
.org285 websites
.de207 websites
.fr190 websites
.co.uk175 websites
.ru173 websites
.nl117 websites
.it89 websites
.net87 websites
.com.br87 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2025-54940

Top websites that are affected by CVE-2025-54940. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**********.com United States*,***
*********.com United States*,***
******************.org United States**,***
**************.com United States**,***
********.com United States**,***
*****.com United States**,***
****.org United States**,***
************.pt Portugal**,***
********.com United States**,***
*************.**.uk GB**,***
See full domain list

FAQ

A total of 4,433 websites have been identified as vulnerable to CVE-2025-54940, based on global website indexing conducted by WebTechSurvey.
The Advanced Custom Fields is affected by the CVE-2025-54940 vulnerability.
Advanced Custom Fields versions up to 6.4.3 are vulnerable to CVE-2025-54940.
CVE-2025-54940 is resolved in version 6.4.3 of Advanced Custom Fields.