NVD disclosure day

Published threat advisories for November 3, 2026

CVE advisoryCRITICAL

CVE-2026-120534

Advanced Custom Fields Extended PRO Code Injection Vulnerability.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical code injection vulnerability exists in the Advanced Custom Fields: Extended PRO WordPress plugin, allowing unauthenticated attackers to execute arbitrary functions. This can occur due to insufficient validation of form configuration parameters, potentially impacting website integrity and operations.

NVD modified: NVD date unavailable
CVE advisoryCRITICAL

CVE-2026-120518

BuddyPress XProfile Image Field Arbitrary File Deletion Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

The BuddyPress XProfile Image Field WordPress plugin has a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server. If your WordPress site has open registration and an image field on the signup form, an attacker could exploit this to delete critical files, potentially leading to remo

NVD modified: NVD date unavailable