CVE-2023-30777: WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)
First published: Wed May 10 2023(Updated: )
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.
Credit: audit@patchstack.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Advanced Custom Fields | <6.1.6 | |
| Advanced Custom Fields | <6.1.6 |
Remedy
Update to 6.1.6 or a higher version.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites?_s_id=cve
- https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-30777.
What is the severity of CVE-2023-30777?
The severity of CVE-2023-30777 is high with a CVSS score of 6.1.
Which software versions are affected by CVE-2023-30777?
The Advanced Custom Fields Pro and Advanced Custom Fields plugins versions up to 6.1.5 for WordPress are affected.
How can I fix CVE-2023-30777?
Update the WP Engine Advanced Custom Fields Pro and WP Engine Advanced Custom Fields plugins to version 6.1.6 or higher.
Where can I find more information about CVE-2023-30777?
You can find more information about CVE-2023-30777 at the following references: [Link 1](https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites?_s_id=cve), [Link 2](https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve), [Link 3](https://patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve).
- agent/type
- agent/softwarecombine
- agent/remedy
- agent/references
- agent/severity
- agent/title
- agent/weakness
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/advancedcustomfields
- canonical/advanced custom fields