In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the free version of ACF, then you can follow the process shown at the advancedcustomfields.com blog URL within the References section below.
Metrics
Affected Vendors & Products
References
History
Mon, 18 Nov 2024 19:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Weaknesses | CWE-79 | |
Metrics |
cvssV3_1
|
Mon, 21 Oct 2024 20:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Thu, 17 Oct 2024 04:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the free version of ACF, then you can follow the process shown at the advancedcustomfields.com blog URL within the References section below. | |
References |
|

Status: PUBLISHED
Assigner: mitre
Published: 2024-10-17T00:00:00
Updated: 2024-11-18T19:03:06.201Z
Reserved: 2024-10-17T00:00:00
Link: CVE-2024-49593

Updated: 2024-10-21T19:21:53.716Z

Status : Awaiting Analysis
Published: 2024-10-17T04:15:03.440
Modified: 2024-11-18T19:35:04.960
Link: CVE-2024-49593

No data.