Vulnerability · Published Sep 4, 2024 · Assigned by jpcert
CVE-2024-45429
Medium 6.1
In plain English
A medium-severity cross-site scripting in Advanced Custom Fields from WP Engine. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker's.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WP Engine | Advanced Custom Fields | 6.3.5 and earlier |
| WP Engine | Advanced Custom Fields Pro | 6.3.5 and earlier |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N