In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the free version of ACF, then you can follow the process shown at the advancedcustomfields.com blog URL within the References section below.
History

Mon, 18 Nov 2024 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}


Mon, 21 Oct 2024 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 17 Oct 2024 04:15:00 +0000

Type Values Removed Values Added
Description In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the free version of ACF, then you can follow the process shown at the advancedcustomfields.com blog URL within the References section below.
References

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-10-17T00:00:00

Updated: 2024-11-18T19:03:06.201Z

Reserved: 2024-10-17T00:00:00

Link: CVE-2024-49593

cve-icon Vulnrichment

Updated: 2024-10-21T19:21:53.716Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-10-17T04:15:03.440

Modified: 2024-11-18T19:35:04.960

Link: CVE-2024-49593

cve-icon Redhat

No data.