Advanced Custom Fields (ACF®)

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 46% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Modeled within the band wp.org reports; tightens as we track daily.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

Most reviewers love how easy ACF makes custom fields, but one recent review calls out the paid-version requirement and outdated support for front-end display.

1. ★★★★★ Augustine

   3mo ago

   Been using ACF on 3 sites now. Adding custom fields to posts/pages w/o touching code is just. My clients can manage their own content easily. Free version covers most use cases tbh. Rlly changed how I build WP sites.

   Read on wp.org ↗
2. ★★★★★ astronyvo

   3mo ago

   Amazing plugin! It allows adding custom fields in a very easy and intuitive way. Great job!

   Read on wp.org ↗
3. ★★★★★ juliana9

   3mo ago

   Wanted 2 add custom info to my posts. ACF is rly powerful for this! U get text boxes, dropdowns & more. 4 stars cz showing the data on the frontend was kinda hard to learn at first. But its a must-have tbh.

   Read on wp.org ↗
4. ★★★★★ bernard56

   3mo ago

   used acf to build a custom portfolio. CPT added fields for client name, year, tags, all frm the dashboard. zero coding needed. worked like a charm tbh. repeater field is pro only tho. free still gets u far This topic was modified 2 months ago by bernard56.

   Read on wp.org ↗
5. ★★★★★ newtonvibe

   4mo ago

   You can make almost anything using the repeater field.

   Read on wp.org ↗
6. ★★★★★ jazmyn30

   4mo ago

   ACF is honestly one of those plugins I keep using again and again. Custom fields are easy to manage, and it helps me build cleaner pages without extra stress.

   Read on wp.org ↗
7. ★★★★★ lizahamid

   4mo ago

   Really useful for adding custom fields, and it helped me manage extra content better. But setup can feel confusing at first, esp for simple users.

   Read on wp.org ↗
8. ★★★★★ deandrmorrow

   4mo ago

   Made custom fields setup really easy for me. Clean interface, simple to manage, and saved a lot of time while building things. Everything worked smoothly on my side.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 6.8.6 Release Date 14th July 2026 Fix – Google Maps field values are no longer double-encoded when saved in an ACF block Fix – Inserting a Link field value in the Classic Editor no longer triggers validation for other required 6.8.6
2. — Version 6.8.5 Release Date 30th June 2026 Security – ACF PRO’s save handler for WooCommerce order fields now verifies security nonces and only attaches on the order edit screen, preventing unauthenticated field value updates for store 6.8.5
3. — Version 6.8.4 Release Date 10th June 2026 Security – ACF AJAX field handlers now validate that the request nonce was created for the expected field type Enhancement – ACF PRO now satisfies plugin dependencies declared against advanced 6.8.4
4. — Version 6.8.3 Release Date 2nd June 2026 Security – The oEmbed field’s AJAX preview no longer performs URL discovery for users without the edit_posts capability. 6.8.3
5. — Version 6.8.2 Release Date 26th May 2026 Security – ACF frontend forms ( acf_form() ) now respect the post_title and post_content form configuration options when processing submissions, ensuring those values are only saved when the fo 6.8.2
6. — Version 6.8.1 Release Date 13th May 2026 Security – ACF now correctly checks user permissions before running database upgrades on a specific site in a multisite network New – A wp.data store ( acf/fields ) is now available in ACF PRO 6.8.1

22 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 5.3 Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters ↗
   2026-05-30 CVE-2026-8382 Missing Authorization Affects <= 6.8.1 Patched in 6.8.2
2. Medium · 5.3 Advanced Custom Fields (ACF®) <= 6.8.1 - Missing Authorization ↗
   2026-05-27 Missing Authorization Affects <= 6.8.1 Patched in 6.8.2
3. Medium · 5.3 Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters ↗
   2026-04-14 CVE-2026-4812 Missing Authorization Affects <= 6.7.0 Patched in 6.7.1
4. Medium · 4.1 Advanced Custom Fields <= 6.4.2. - HTML Injection ↗
   2025-08-08 CVE-2025-54940 Improper Input Validation Affects <= 6.4.2 Patched in 6.4.3
5. Medium · 4.4 Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
   2024-10-15 CVE-2024-49593 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.3.6 Patched in 6.3.9
6. Medium · 5.1 Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call ↗
   2024-10-07 CVE-2024-9529 Improper Control of Generation of Code ('Code Injection') Affects <= 6.3.6 Patched in 6.3.9
7. Medium · 5.5 Advanced Custom Fields <= 6.3.5 - Authenticated Stored Cross-Site Scripting ↗
   2024-09-04 CVE-2024-45429 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.3.5 Patched in 6.3.6
8. Medium · 4.3 Advanced Custom Fields <= 6.2.10 - Authenticated (Contributor+) Arbitrary Custom Field Access ↗
   2024-05-30 CVE-2024-4565 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 6.2.10 Patched in 6.3.0
9. Medium · 6.4 Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field ↗
   2024-01-17 CVE-2023-6701 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.2.4 Patched in 6.2.5
10. Medium · 4.4 Advanced Custom Fields 6.1 - 6.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2023-08-03 CVE-2023-40068 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects 6.1 - 6.1.7 Patched in 6.1.8
11. Medium · 6.1 Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5 & 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status' ↗
    2023-05-04 CVE-2023-30777 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects 5.8.10 - 5.12.5 Patched in 5.12.6
12. High · 8.8 Advanced Custom Fields <= 6.0.7 - Authenticated (Contributor+) PHP Object Injection ↗
    2023-04-03 CVE-2023-1196 Deserialization of Untrusted Data Affects <= 5.12.4 Patched in 5.12.5
13. Medium · 4.3 Advanced Custom Fields <= 6.0.2 - Authenticated (Contributor+) Information Disclosure ↗
    2022-10-18 CVE-2022-40696 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 6.0.2 Patched in 6.0.3
14. Medium · 4.3 Advanced Custom Fields <= 5.12.2 - File Upload ↗
    2022-07-14 CVE-2022-2594 Missing Authorization Affects <= 5.12.2 Patched in 5.12.3
15. Medium · 6.5 Advanced Custom Fields <= 5.12 - Authenticated Information Disclosure ↗
    2022-03-30 CVE-2022-23183 Missing Authorization Affects < 5.12.1 Patched in 5.12.1
16. Medium · 4.3 Advanced Custom Fields <= 5.10 - Missing Authorization on Option Changes ↗
    2021-12-02 CVE-2021-20867 Missing Authorization Affects < 5.11 Patched in 5.11
17. High · 7.5 Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure ↗
    2021-12-02 CVE-2021-20865 Missing Authorization Affects < 5.11 Patched in 5.11
18. Medium · 6.5 Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure ↗
    2021-12-02 CVE-2021-20866 Missing Authorization Affects < 5.11 Patched in 5.11
19. Medium · 6.1 Advanced Custom Fields <= 5.8.11 - Cross-Site Scripting ↗
    2020-06-10 CVE-2020-36172 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.8.12 Patched in 5.8.12
20. Medium · 5.4 Advanced Custom Fields <= 5.7.11 - PHP Object Injection ↗
    2019-02-15 Deserialization of Untrusted Data Affects <= 5.7.11 Patched in 5.7.12
21. Medium · 5.4 Advanced Custom Fields <= 5.7.7 - Author+ Stored Cross-Site Scripting ↗
    2018-12-07 CVE-2018-20986 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.7.8 Patched in 5.7.8
22. Low · 3.8 Advanced Custom Fields <= 3.5.1 - Remote Code Execution via Remote File Inclusion ↗
    2013-01-03 CVE-2012-10025 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 3.5.1 Patched in 3.5.2

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 56 languages, 21 at 90% or more

Plus 32 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

No tier crossings observed yet.

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Advanced Custom Fields: Extended 100K+ installs · 4.7★ · 4 shared tags B
• Secure Custom Fields 90K+ installs · 4.6★ · 3 shared tags B
• Custom Field Template 30K+ installs · 4.0★ · 3 shared tags B
• Ultimate Fields 500+ installs · 4.6★ · 3 shared tags D
• Advanced Gallery & Repeater Fields for ACF 400+ installs · 3.6★ · 3 shared tags B
• ACF Fold Flexible Content 300+ installs · 4.1★ · 3 shared tags D

Embed this report card

Drop a live Pulse card for Advanced Custom Fields (ACF®) into a readme, a review or a deck. It updates itself.

Advanced Custom Fields (ACF®): 2M+ active installs, 4.5★ (1,438 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/advanced-custom-fields