WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)
CVE-2023-30777

7.1HIGH

Key Information:

Vendor: WordPress
Status: Advanced Custom Fields Pro; Advanced Custom Fields
Vendor: CVE Published:; 10 May 2023

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 86%

What is CVE-2023-30777?

The vulnerability in WP Engine Advanced Custom Fields Pro and Advanced Custom Fields plugins allows attackers to exploit unauthenticated reflected cross-site scripting (XSS) attacks. When a user visits a specially crafted URL, the malicious script can execute in their browser, exposing sensitive user data and compromising the site’s security. This flaw affects up to 2 million websites, highlighting the importance of immediate remediation and patches to ensure robust protection against potential exploitation.

Affected Version(s)

Advanced Custom Fields <= 6.1.5

Advanced Custom Fields Pro <= 6.1.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-30777
Created by Alucard0x1