CVE-2024-49593
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the free version of ACF, then you can follow the process shown at the advancedcustomfields.com blog URL within the References section below.
| Vendor | n/a |
| Product | n/a |
| Published | Oct 17, 2024 |
| Last Updated | Nov 18, 2024 |
Stay Ahead of the Next One
Get instant alerts for n/a n/a
Be the first to know when new medium vulnerabilities affecting n/a n/a are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
n/a / n/a
n/a
References
wordpress.org: https://wordpress.org/plugins/advanced-custom-fields/#developers advancedcustomfields.com: https://www.advancedcustomfields.com/changelog/ advancedcustomfields.com: https://www.advancedcustomfields.com/blog/installing-and-upgrading-to-the-latest-version-of-acf/ x.com: https://x.com/wp_acf/status/1845190372764401908