← Back to CVEs

CVE-2024-45429

MEDIUM

6.1

Description

Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker's.

CVE Details

CVSS v3.1 Score6.1

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published9/4/2024

Last Modified3/25/2025

Sourcenvd

Honeypot Sightings0

Affected Products

wpengine:advanced_custom_fields

Weaknesses (CWE)

CWE-79CWE-79

References

https://jvn.jp/en/jp/JVN67963942/(vultures@jpcert.or.jp)

https://wordpress.org/plugins/advanced-custom-fields/(vultures@jpcert.or.jp)

https://www.advancedcustomfields.com/(vultures@jpcert.or.jp)

https://www.advancedcustomfields.com/blog/acf-6-3-6/(vultures@jpcert.or.jp)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.