CVE-2024-49593

Oct. 18, 2024, 12:53 p.m.

Tags

cve@mitre.org
2024-10-17
CVE-2024-49593

Product(s) Impacted

Advanced Custom Fields (ACF)

  • before 6.3.9

Description

In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the free version of ACF, then you can follow the process shown at the advancedcustomfields.com blog URL within the References section below.

Weaknesses

Date

Published: Oct. 17, 2024, 4:15 a.m.

Last Modified: Oct. 18, 2024, 12:53 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

References

https://wordpress.org/plugins/advanced-custom-fields/#developers
cve@mitre.org
https://www.advancedcustomfields.com/blog/installing-and-upgrading-to-the-latest-version-of-acf/
cve@mitre.org
https://www.advancedcustomfields.com/changelog/
cve@mitre.org
https://x.com/wp_acf/status/1845190372764401908
cve@mitre.org