Wp Engine Advanced Custom Fields Pro vulnerabilities

3 known vulnerabilities affecting wp_engine/advanced_custom_fields_pro.

Total CVEs

3

CISA KEV

0

Public exploits

1

Exploited in wild

1

Severity breakdown

MEDIUM3

Vulnerabilities

Page 1 of 1

CVE-2024-45429MEDIUMCVSS 6.1v6.3.5 and earlier2024-09-04

CVE-2024-45429 [MEDIUM] CWE-79 CVE-2024-45429: Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and A Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged

CVE-2023-40068MEDIUMCVSS 5.4vversions 6.1.0 to 6.1.72023-08-21

CVE-2023-40068 [MEDIUM] CWE-79 CVE-2023-40068: Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Cu Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.

CVE-2023-30777MEDIUMCVSS 6.1ExploitedPoC≥ n/a, ≤ 6.1.52023-05-10

CVE-2023-30777 [MEDIUM] CWE-79 CVE-2023-30777: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.