CVE-2023-40068

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

5.4MEDIUM

EPSS

29.9%

top 3.35%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Advancedcustomfields Advanced Custom Fields WP Engine Advanced Custom Fields WP Engine Advanced Custom Fields PRO

Timeline

PublishedAug 21

Description

Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶NVDadvancedcustomfields/advanced_custom_fields6.1.0 — 6.1.7

▶CVEListV5wp_engine/advanced_custom_fieldsversions 6.1.0 to 6.1.7

▶CVEListV5wp_engine/advanced_custom_fields_proversions 6.1.0 to 6.1.7

🔴Vulnerability Details

CVEList

CVE-2023-40068: Cross-site scripting vulnerability in Advanced Custom Fields versions 6↗2023-08-21

▶

GHSA

GHSA-87x7-f7g8-6px2: Cross-site scripting vulnerability in Advanced Custom Fields versions 6↗2023-08-21

▶