CVE-2024-49593

The WordPress plugins Advanced Custom Fields (ACF) (versions prior to 6.3.9) and Secure Custom Fields (versions prior to 6.3.6.3) are vulnerable to a stored Cross-Site Scripting (XSS) flaw. The root cause exists in the Field Group editor , where editing one of the plugin's fields can lead to the ...

CVE-2024-49593: Improper Neutralization of Input During Web Page Generation

In Advanced Custom Fields ACF before 6.3.9 and Secure Custom Fields before 6.3.6.3 plugins for WordPress, using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the fr...

PT-2024-33558 · WordPress · Advanced Custom Fields Pro +1

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields ACF versions prior to 6.3.9 Secure Custom Fields versions prior to 6.3.6.3 Description: The issue allows for the execution of a stored XSS payload when using the Field Group editor to edit one of the plugin's fields in...