Advanced Custom Fields stored XSS via HTML attribute name injection
A WordPress input-field plugin can have malicious scripts planted that run in visitors' browsers.
Summary
A flaw in how the Advanced Custom Fields (ACF) WordPress plugin stores field definitions lets an unauthenticated attacker run JavaScript in the browsers of visitors and administrators. Versions before 6.8.11 are affected.
What to do
Update Advanced Custom Fields to 6.8.11 or later.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
Times
First published
First seen