CVE-2024-45429: XSS
Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker's.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45429?
CVE-2024-45429 is classified as a cross-site scripting (XSS) vulnerability which can potentially allow attackers to execute arbitrary scripts in user browsers.
What versions are affected by CVE-2024-45429?
CVE-2024-45429 affects Advanced Custom Fields versions 6.3.5 and earlier, as well as Advanced Custom Fields Pro versions 6.3.5 and earlier.
How do I fix CVE-2024-45429?
To mitigate the risk of CVE-2024-45429, update to the latest version of Advanced Custom Fields or Advanced Custom Fields Pro that patches this vulnerability.
Who is vulnerable to CVE-2024-45429?
Users who have implemented Advanced Custom Fields or Advanced Custom Fields Pro up to version 6.3.5 are vulnerable if the 'capability' setting is misconfigured.
What impact does CVE-2024-45429 have on my website?
If exploited, CVE-2024-45429 can allow an attacker to inject malicious scripts into your website, compromising user data and potentially gaining control over user sessions.