New Vulnerability in Popular WordPress Plugin Exposes Over 2 Million Sites to Cyberattacks

🗓️ 06 May 2023 05:41:00Reported by The Hacker NewsType

Reflected XSS in Advanced Custom Fields 6.1.6 enables unauthenticated privilege escalation via a crafted URL.

Reporter	Title	Published	Views	Family All 91
GithubExploit	Exploit for Cross-site Scripting in Cpanel	17 May 202320:46	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Cpanel	21 Apr 202412:26	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Cpanel	14 Apr 202408:29	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Cpanel	5 Jun 202511:26	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Cpanel	27 Apr 202320:51	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Advancedcustomfields Advanced_Custom_Fields	17 Jun 202312:43	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Cpanel	17 Oct 202311:18	–	githubexploit
ATTACKERKB	CVE-2023-29489	27 Apr 202321:15	–	attackerkb
BDU FSTEC	The vulnerability of the cPanel control panel for web hosting arises from the lack of protective measures for the website structure, allowing attackers to compromise the confidentiality and integrity of the protected information.	29 May 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Advanced Custom Fields plugin in the WordPress content management system allows attackers to perform cross-site scripting attacks.	25 Jul 202300:00	–	bdu_fstec

15 May 2023 11:40Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.16.1 - 7.1

EPSS0.65533

SSVC