Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)
CVE-2021-24241

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Advanced Custom Fields Pro
Vendor
CVE Published:
22 April 2021

What is CVE-2021-24241?

The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.

Affected Version(s)

Advanced Custom Fields Pro 5.9.1

References

https://wpscan.com/vulnerability/d1e9c995-37bd-4952-b88e-...
x_refsource_CONFIRM
https://github.com/jdordonezn/Reflected-XSS-in-WordPress-...
x_refsource_MISC
https://www.advancedcustomfields.com/blog/acf-5-9-1-release/
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Juan David Ordoñez Noriega
.
CVE-2021-24241 : Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)