Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Arbitrary Function Execution vulnerability

Contributor+ Arbitrary Function Execution vulnerability discovered by Security audit in WordPress Plugin Advanced Custom Fields PRO versions 6.2.10...

PT-2023-27245

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields versions 6.1.0 through 6.1.7 Advanced Custom Fields Pro versions 6.1.0 through 6.1.7 Description A cross-site scripting vulnerability allows a remote authenticated attacker to execute an arbitrary script on the web brows...

CVE-2023-40068: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative...

CVE-2023-30777

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins = 6.1.5 versions...

CVE-2023-30777

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins = 6.1.5 versions...

CVE-2023-30777

The Advanced Custom Fields and Advanced Custom Fields Pro WordPress plugins (versions prior to 6.1.6 ) are vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the post_status parameter. An attacker can inject arbitrary scri...

CVE-2023-30777

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins = 6.1.5 versions...

CVE-2023-30777: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins = 6.1.5 versions...

CVE-2022-2594: Unrestricted Upload of File with Dangerous Type

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration so PHP is not possible if there is a frontend form available. This vulnerability was introduced i...

PT-2022-15903

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields versions prior to 5.12.1 Advanced Custom Fields Pro versions prior to 5.12.1 Description A missing authorization issue allows a remote authenticated attacker to view database information without proper access permission...

CVE-2022-23183: Missing Authorization

Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission...

CVE-2021-20867

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors...

CVE-2021-20866

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors...

PT-2021-14308

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields versions prior to 5.11 Advanced Custom Fields Pro versions prior to 5.11 Description: The issue concerns a missing authorization vulnerability in the browsing database. This may allow a user to browse unauthorized data...

PT-2021-14310

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields versions prior to 5.11 Advanced Custom Fields Pro versions prior to 5.11 Description: The issue concerns a missing authorization vulnerability in moving the field group. This may allow a user to move an unauthorized fie...

CVE-2021-20865: Missing Authorization

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors...

CVE-2021-20866: Missing Authorization

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors...

CVE-2021-20867: Missing Authorization

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors...

PT-2021-14309

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields versions prior to 5.11 Advanced Custom Fields Pro versions prior to 5.11 Description: The issue concerns a missing authorization vulnerability in obtaining the user list. This may allow a user to obtain unauthorized...

WordPress Cross-Site Scripting Vulnerability (CNVD-2021-44307)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin Advanced Custom Fields Pro versions...