CoreCVE
Back

MEDIUM

In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload

Published Oct 17, 2024

Description

In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the free version of ACF, then you can follow the process shown at the advancedcustomfields.com blog URL within the References section below.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Oct 17, 2024
Updated Nov 18, 2024
Reserved Oct 17, 2024
Link CVE-2024-49593
CISA Vulnrichment
Updated Oct 21, 2024
NVD
Status Deferred
Modified Jun 17, 2026
Link CVE-2024-49593
Red Hat
Severity n/a
Public date n/a
Links CVE-2024-49593