WordPress Advanced Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Duc Luong Tran in WordPress Plugin Advanced Custom Fields versions = 6.3.6.2...

PT-2024-33558 · WordPress · Advanced Custom Fields Pro +1

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields ACF versions prior to 6.3.9 Secure Custom Fields versions prior to 6.3.6.3 Description: The issue allows for the execution of a stored XSS payload when using the Field Group editor to edit one of the plugin's fields in...

WordPress Advanced Custom Fields Plugin <= 6.3.6.2 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Custom Fields Type Plugin Vulnerable versions = 6.3.6.2 Fixed in 6.3.6.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID fb0621a063a9 Credits Duc Luong Tran Required privilege...

WordPress Plugin Jetpack Patches Major Vulnerability Affecting 27 Million Sites

The maintainers of the Jetpack WordPress plugin have released a security update to remediate a critical vulnerability that could allow logged-in users to access forms submitted by others on a site. Jetpack, owned by WordPress maker Automattic, is an all-in-one plugin that offers a comprehensive...

WordPress Advanced Custom Fields PRO plugin <= 6.3.7 - Administrator+ Limited Arbitrary Function Call vulnerability

Administrator+ Limited Arbitrary Function Call vulnerability discovered by Automattic Security Team in WordPress Plugin Advanced Custom Fields PRO versions = 6.3.7...

WordPress Advanced Custom Fields PRO Plugin <= 6.3.7 is vulnerable to Arbitrary Code Execution

Software Advanced Custom Fields PRO Type Plugin Vulnerable versions = 6.3.7 Fixed in 6.3.8 OWASP Top 10 A3: Injection Classification Arbitrary Code Execution CVE CVE-2024-9529 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID aa150d72013d Credits Automattic Security Team...

WordPress Advanced Custom Fields plugin <= 6.3.6 - Administrator+ Limited Arbitrary Function Call vulnerability

Administrator+ Limited Arbitrary Function Call vulnerability discovered by Automattic Security Team in WordPress Plugin Advanced Custom Fields versions = 6.3.6...

WordPress Advanced Custom Fields Plugin <= 6.3.6 is vulnerable to Arbitrary Code Execution

Software Advanced Custom Fields Type Plugin Vulnerable versions = 6.3.6 Fixed in 6.3.6.1 OWASP Top 10 A1: Injection Classification Arbitrary Code Execution CVE CVE-2024-9529 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2b40e735610b Credits Automattic Security Team...

PT-2024-39679 · WordPress · Secure Custom Fields +1

Name of the Vulnerable Software and Affected Versions: Secure Custom Fields WordPress plugin versions prior to 6.3.9 Advanced Custom Fields Pro WordPress plugin versions prior to 6.3.9 Description: The issue allows high privilege users, such as admins, to run arbitrary PHP functions through the...

WordPress Advanced Custom Fields PRO plugin < 5.11 - Missing Authorization to Information Disclosure vulnerability

Missing Authorization to Information Disclosure vulnerability discovered by Keitaro Yamazaki in WordPress Plugin Advanced Custom Fields PRO versions 5.11...

WordPress Advanced Custom Fields plugin < 5.11 - Missing Authorization to Information Disclosure vulnerability

Missing Authorization to Information Disclosure vulnerability discovered by Keitaro Yamazaki in WordPress Plugin Advanced Custom Fields versions 5.11...

WordPress Advanced Custom Fields PRO plugin < 5.11 - Missing Authorization to Information Disclosure vulnerability

Missing Authorization to Information Disclosure vulnerability discovered by Keitaro Yamazaki in WordPress Plugin Advanced Custom Fields PRO versions 5.11...

WordPress Advanced Custom Fields plugin < 5.11 - Missing Authorization to Information Disclosure vulnerability

Missing Authorization to Information Disclosure vulnerability discovered by Keitaro Yamazaki in WordPress Plugin Advanced Custom Fields versions 5.11...

WordPress Advanced Custom Fields PRO plugin < 5.11 - Missing Authorization on Option Changes vulnerability

Missing Authorization on Option Changes vulnerability discovered by Keitaro Yamazaki in WordPress Plugin Advanced Custom Fields PRO versions 5.11...

WordPress Advanced Custom Fields plugin < 5.11 - Missing Authorization on Option Changes vulnerability

Missing Authorization on Option Changes vulnerability discovered by Keitaro Yamazaki in WordPress Plugin Advanced Custom Fields versions 5.11...

WordPress Advanced Custom Fields Plugin < 5.11 is vulnerable to Broken Access Control

Software Advanced Custom Fields Type Plugin Vulnerable versions 5.11 Fixed in 5.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2021-20867 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 205fd390910c Credits Keitaro Yamazaki Required...

WordPress Advanced Custom Fields PRO Plugin < 5.11 is vulnerable to Broken Access Control

Software Advanced Custom Fields PRO Type Plugin Vulnerable versions 5.11 Fixed in 5.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2021-20867 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 38d705c1f970 Credits Keitaro Yamazaki...

WordPress Advanced Custom Fields PRO Plugin < 5.11 is vulnerable to Broken Access Control

Software Advanced Custom Fields PRO Type Plugin Vulnerable versions 5.11 Fixed in 5.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2021-20866 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 36e7531caa36 Credits Keitaro Yamazaki...

WordPress Advanced Custom Fields Plugin < 5.11 is vulnerable to Broken Access Control

Software Advanced Custom Fields Type Plugin Vulnerable versions 5.11 Fixed in 5.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2021-20866 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3c61745fb42a Credits Keitaro Yamazaki Required...

WordPress Advanced Custom Fields Plugin < 5.11 is vulnerable to Broken Access Control

Software Advanced Custom Fields Type Plugin Vulnerable versions 5.11 Fixed in 5.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2021-20865 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4a4b648ba0bb Credits Keitaro Yamazaki Required...