CVE-2023-6701: Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6701?
CVE-2023-6701 has been rated as a high severity vulnerability due to its potential to allow stored cross-site scripting attacks.
How do I mitigate the risk of CVE-2023-6701?
To mitigate the risk of CVE-2023-6701, you should update the Advanced Custom Fields plugin to version 6.2.5 or later.
Who is affected by CVE-2023-6701?
CVE-2023-6701 affects users of the Advanced Custom Fields plugin for WordPress versions up to and including 6.2.4.
What type of vulnerability is CVE-2023-6701?
CVE-2023-6701 is classified as a stored cross-site scripting vulnerability due to inadequate input sanitization.
Can CVE-2023-6701 be exploited remotely?
CVE-2023-6701 can be exploited remotely by authenticated users with contributor-level access to the affected WordPress site.