Vulnerability · Published May 10, 2023 · Assigned by Patchstack
CVE-2023-30777WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)
High 7.1
In plain English
A high-severity cross-site scripting in Advanced Custom Fields from WP Engine. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 39.0% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)39.0%top 1.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC
Official description
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WP Engine | Advanced Custom Fields Pro | n/a – through 6.1.5 |
| WP Engine | Advanced Custom Fields | n/a – through 6.1.5 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
References
- https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites?_s_id=cve technical-description