← Volver a CVEs

CVE-2024-45429

MEDIUM

6.1

Descripcion

Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker's.

Detalles CVE

Puntuacion CVSS v3.16.1

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado9/4/2024

Ultima modificacion3/25/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

wpengine:advanced_custom_fields

Debilidades (CWE)

CWE-79CWE-79

Referencias

https://jvn.jp/en/jp/JVN67963942/(vultures@jpcert.or.jp)

https://wordpress.org/plugins/advanced-custom-fields/(vultures@jpcert.or.jp)

https://www.advancedcustomfields.com/(vultures@jpcert.or.jp)

https://www.advancedcustomfields.com/blog/acf-6-3-6/(vultures@jpcert.or.jp)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.