Advanced Custom Fields: Extended

Reviewers keep praising the extra ACF field types and Konrad's fast, detailed support, with the only gripes being a steep learning curve for beginners and unclear free versus pro labelling.

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

260 searches this plugin appeared in over the last 90 days, 20 listed. 232 left out as unrelated or noise (years, numbers, stray words). 2 of its tags aren't in the top 24 for their own search.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 86% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 14 months ago; a band this size takes about a year or more to cross, which places it about 90% of the way through.

1. ★★★★★ Coditive

   1.7y ago

   We love the simplicity of using Advanced Custom Fields: Extended to build custom Gutenberg blocks. It offers powerful features and seamless integration, making it easier than ever to create dynamic content. A perfect tool for streamlining custom WordPress development.

   Read on wp.org ↗
2. ★★★★★ 14oangus

   1.8y ago

   Both times when I needed support, Konrad was quick to point out the cause and provide detailed explanation and solution. The plugin is awesome but what stands out is the support quality. It gives me confidence in continuing to use the plugin.

   Read on wp.org ↗
3. ★★★★★ gspowart

   1.9y ago

   Great, detailed support from Konrad on my very specific issue.

   Read on wp.org ↗
4. ★★★★★ tomo55555

   2.1y ago

   After great support I realised my mistake not understanding the full extent of why the plugin settings caused me a few issues. I am now giving this plugin 5 stars, but would like more tutorial videos for novices like me please – which is a bit greedy considering I am using the free version 🙂 This topic was modified 1 year, 10 months ago by tomo55555.

   Read on wp.org ↗
5. ★★★★★ 61pixels

   2.2y ago

   So many great additions to ACF, I only wish I had found it 10 years ago. For the past couple of years it’s become a staple of everyone of my builds providing dynamic Flexible Content previews on the backend. My clients love it and it gives a much better editing experience. Not to mention all of the other features and additions it brings to the table.

   Read on wp.org ↗
6. ★★★★★ muneebkiani

   2.2y ago

   The support is quick and professional. Well-built reliable plugin.

   Read on wp.org ↗
7. ★★★★★ pzh20

   2.3y ago

   I’ve been using a paid for plugin in my Elementor sites for several years, and this ‘free’ version is just as powerful, if not moreso. It also offers several other features that extend ACF even more. I can’t find anything to critisise this plugin, except that it’s not designed for the novice. Don’t get me wrong, if you do not need to extend or reconfigure the data before saving, it’s perfect, but if you need to manipulate the data, you’ll need a reasonable understanding of WordPress and ACF Actions, Filters and Hooks. I’m probably going to buy the Pro version just to reward the developer for his efforts even though I do not currently need the additional features.

   Read on wp.org ↗
8. ★★★★★ dbrabyn

   3.0y ago

   Highly recommended.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 0.9.2.6 ACF Extended Pro 0.9.2.6: Field: AI Chat – New field that render a fully customizable LLM chat interface (WP 7.0+) Field: AI Chat – Compatible with Text and Images generation at the moment Field: AI Chat – The field is f 0.9.2.6
2. — Version 0.9.2.5 ACF Extended Pro 0.9.2.5: Field: Select – Enhanced “Stylised UI” compatibility on Woocommerce admin pages Field: Select – This fix also applies to Countries, Currencies, Languages fields Field: Phone Number – Fixed JS er 0.9.2.5
3. — Version 0.9.2.4 Deprecation Notice: Support of ACF Pro 5.8 (2019) will be dropped on September 2026. Please upgrade to ACF Pro 5.9 or higher to maintain compatibility with future versions of ACF Extended. ACF Extended Pro 0.9.2.4: Field 0.9.2.4
4. — Version 0.9.2.3 ACF Extended Pro 0.9.2.3: Field: Color Picker – Fixed “Color Palette” when copy/pasting with a Flexible Content Field: Date Range Picker – Added “Return Type: Array (default) / String” setting Field: Date Range Picker – 0.9.2.3
5. — Version 0.9.2.2 ACF Extended Pro 0.9.2.2: Field: Fields – Added “Group by field group” setting Field: Field Types – Added “Group by category” setting Fields: Fixed missing “Add choice” button when using “Display: Checkbox” and “Allow Cu 0.9.2.2
6. — Version 0.9.2.1 ACF Extended Pro 0.9.2.1: Field: Flexible Content – Grid System – Fixed Copy/Paste “Secondary Button” in small columns Field: Flexible Content – Grid System – Fixed multi-level Flexible Content icons in small columns Fie 0.9.2.1

All 20 disclosed vulnerabilities are patched in the current version (0.9.2.8). Sites still on an older version should update.

1. Patched High · 7.5 Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection ↗
   2026-10-30 CVE-2026-110305 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 0.9.2.7 Patched in 0.9.2.8
2. Patched Medium · 5.3 Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints ↗
   2026-10-27 CVE-2026-2839 Missing Authorization Affects <= 0.9.2.7 Patched in 0.9.2.8
3. Patched Medium · 4.8 Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field ↗
   2026-10-26 CVE-2026-10752 Missing Authorization Affects <= 0.9.2.6 Patched in 0.9.2.7
4. Patched High · 7.3 Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Arbitrary Non-Admin Account Takeover ↗
   2026-10-23 CVE-2026-94262 Improper Authentication Affects 0.9.2.7 Patched in 0.9.2.8
5. Patched Medium · 6.4 Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-10-23 CVE-2026-94264 Improper Neutralization of Input During Web Page Generation Affects 0.8.9.4 - 0.9.2.7 Patched in 0.9.2.8
6. Patched Critical · 9.8 Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Privilege Escalation via Account Takeover ↗
   2026-10-23 CVE-2026-94268 Authorization Bypass Through User-Controlled Key Affects 0.9.2.7 Patched in 0.9.2.8
7. Patched Critical · 9.8 Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Remote Code Execution ↗
   2026-10-23 CVE-2026-94267 Improper Control of Generation of Code Affects < 0.9.2.8 Patched in 0.9.2.8
8. Patched Medium · 6.5 Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution ↗
   2026-10-21 CVE-2026-94263 Improper Control of Generation of Code Affects 0.9.2.4 - 0.9.2.7 Patched in 0.9.2.8
9. Patched High · 7.2 Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-10-20 CVE-2026-112313 Improper Neutralization of Input During Web Page Generation Affects <= 0.9.2.7 Patched in 0.9.2.8
10. Patched Critical · 9.1 Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Arbitrary File Deletion ↗
    2026-10-20 CVE-2026-112311 Improper Limitation of a Pathname to a Restricted Directory Affects <= 0.9.2.7 Patched in 0.9.2.8
11. Patched Medium · 5.3 Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization ↗
    2026-10-20 CVE-2026-112312 Missing Authorization Affects <= 0.9.2.7 Patched in 0.9.2.8
12. Patched High · 7.3 Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation ↗
    2026-09-03 CVE-2026-80467 Improper Privilege Management Affects 0.9.2.2 - 0.9.2.6 Patched in 0.9.2.7
13. Patched Critical · 9.8 Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Privilege Escalation via Administrator Account Takeover ↗
    2026-08-31 CVE-2026-12526 Unverified Password Change Affects < 0.9.2.7 Patched in 0.9.2.7
14. Patched Medium · 4.3 Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization ↗
    2026-08-27 CVE-2026-81284 Missing Authorization Affects <= 0.9.2.6 Patched in 0.9.2.7
15. Patched Critical · 9.8 Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter ↗
    2026-05-28 CVE-2026-8809 Improper Privilege Management Affects <= 0.9.2.5 Patched in 0.9.2.6
16. Patched Medium · 6.5 Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution ↗
    2026-05-12 CVE-2025-15463 Improper Control of Generation of Code Affects <= 0.9.2.3 Patched in 0.9.2.4
17. Patched Critical · 9.8 Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action ↗
    2026-01-19 CVE-2025-14533 Improper Privilege Management Affects <= 0.9.2.1 Patched in 0.9.2.2
18. Patched Critical · 9.8 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form ↗
    2025-12-02 CVE-2025-13486 Improper Control of Generation of Code Affects 0.9.0.5 - 0.9.1.1 Patched in 0.9.2
19. Patched Medium · 6.4 Advanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-09-29 CVE-2023-5292 Improper Neutralization of Input During Web Page Generation Affects <= 0.8.9.3 Patched in 0.8.9.4
20. Patched High · 7.2 Advanced Custom Fields: Extended <= 0.8.8.6 - Admin+ SQL Injection ↗
    2021-12-24 CVE-2021-24865 Improper Neutralization of Special Elements used in an SQL Command Affects <= 0.8.8.6 Patched in 0.8.8.7

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 22 languages, 5 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-08-30 90K+ → 100K+ up after 1 days in tier
2. 2025-08-29 100K+ → 90K+ down after 2 days in tier
3. 2025-08-27 90K+ → 100K+ up after 33 days in tier
4. 2025-07-25 100K+ → 90K+ down after 1 days in tier
5. 2025-07-24 90K+ → 100K+ up after 423 days in tier
6. 2024-05-27 80K+ → 90K+ up after 1 days in tier
7. 2024-05-26 90K+ → 80K+ down after 1 days in tier
8. 2024-05-25 80K+ → 90K+ up after 249 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Advanced Custom Fields: Extended into a readme, a review or a deck. It updates itself.

Advanced Custom Fields: Extended: 100K+ active installs, 4.8★ (132 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/acf-extended