Vulnerability Details CVE-2021-24241
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 69.3%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
References
- https://github.com/jdordonezn/Reflected-XSS-in-WordPress-for-ACF-PRO-before-5.9.1-plugin/issues/1
- https://wpscan.com/vulnerability/d1e9c995-37bd-4952-b88e-945e02e3c83f
- https://www.advancedcustomfields.com/blog/acf-5-9-1-release/
- https://github.com/jdordonezn/Reflected-XSS-in-WordPress-for-ACF-PRO-before-5.9.1-plugin/issues/1
- https://wpscan.com/vulnerability/d1e9c995-37bd-4952-b88e-945e02e3c83f
- https://www.advancedcustomfields.com/blog/acf-5-9-1-release/
Products affected by CVE-2021-24241
-
cpe:2.3:a:advancedcustomfields:advanced_custom_fields:-
-
cpe:2.3:a:advancedcustomfields:advanced_custom_fields:5.8.13
-
cpe:2.3:a:advancedcustomfields:advanced_custom_fields:5.8.14
-
cpe:2.3:a:advancedcustomfields:advanced_custom_fields:5.9.0