CVE-2023-30777

The Advanced Custom Fields plugin for WordPress contains a reflected cross-site scripting vulnerability affecting versions 5.8.10 through 5.12.5 and 6.0.0 through 6.1.5, exploitable through the post_status parameter due to inadequate sanitization and escaping of user input. An unauthenticated attacker could craft a malicious link that, when clicked by a user, executes arbitrary JavaScript code in the victim's browser. The vulnerability stems from the plugin's failure to properly validate and escape the parameter value before displaying it on the page.

Based on public CVE data (MITRE/NVD).