Stored Cross-Site Scripting in Advanced Custom Fields: Extended for WordPress
CVE-2023-5292
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 October 2023
What is CVE-2023-5292?
The Advanced Custom Fields: Extended plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping on the 'acfe_form' shortcode. Authenticated attackers with contributor-level or higher permissions can exploit this vulnerability to inject malicious web scripts into pages. These scripts will execute whenever a user visits the compromised page, posing serious risks to user data and site integrity.
Affected Version(s)
Advanced Custom Fields: Extended * <= 0.8.9.3