⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2023-30777 — Cross-site Scripting in Advanced Custom Fields

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
6.1MEDIUMNVD
CNA7.1VulnCheck7.1
EPSS
83.3%
top 0.73%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
3
Advancedcustomfields Advanced Custom FieldsWP Engine Advanced Custom FieldsWP Engine Advanced Custom Fields PRO
Timeline
PublishedMay 10
Latest updateJul 6

Description

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5wp_engine/advanced_custom_fieldsn/a — 6.1.5
▶CVEListV5wp_engine/advanced_custom_fields_pron/a — 6.1.5

🔴Vulnerability Details

3
GHSA
GHSA-c463-967w-9f3r: Unauth↗2023-07-06
▶
CVEList
WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)↗2023-05-10
▶
VulnCheck
advancedcustomfields advanced_custom_fields Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')↗2023
▶

💥Exploits & PoCs

1
Nuclei
Advanced Custom Fields < 6.1.6 - Cross-Site Scripting
▶
CVE-2023-30777 — Cross-site Scripting | cvebase