Advancedcustomfields: >> Advanced Custom Fields Security Vulnerabilities
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.
CVSS Score
7.5
EPSS Score
0.006
Published
2021-12-13
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.
CVSS Score
6.5
EPSS Score
0.004
Published
2021-12-13
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.
CVSS Score
6.1
EPSS Score
0.006
Published
2021-04-22
The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.
CVSS Score
6.1
EPSS Score
0.002
Published
2021-01-06
The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.
CVSS Score
5.4
EPSS Score
0.002
Published
2019-08-22
Page 2