Now officially on WordPress.org

CVE Database / CVE-2024-45429

CVE · Medium

CVE-2024-45429 — Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.3.6

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-45429 Advanced Custom Fields (ACF®) [advanced-custom-fields] < 6.3.6 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 6.1 < 6.3.6 6.3.6 2024-09-04 —

CVE-2024-45429

The Advanced Custom Fields plugin for WordPress contains a stored cross-site scripting vulnerability affecting versions 6.3.5 and earlier in its field groups functionality. The flaw stems from inadequate sanitization of inputs and escaping of outputs, allowing authenticated users with capability-setting privileges to insert malicious scripts into pages. When other users visit these compromised pages, the injected scripts execute in their browsers, posing a security risk. The vulnerability was fixed in version 6.3.6.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings