logo
DATABASE RESOURCES PRICING ABOUT US

Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)

Description

The plugin did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page. ### PoC The PoC will be displayed on April 16, 2021, to give users the time to update.


Affected Software


CPE Name Name Version
advanced-custom-fields-pro 5.9.1

Related