Type a vendor name or a vulnerability id.



All the vulnerabilites related to WP Engine - Advanced Custom Fields
cve-2023-40068
Vulnerability from cvelistv5
Published
2023-08-21 08:13
Modified
2024-08-02 18:24
Severity
Summary
Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.
References
URLTags
https://www.advancedcustomfields.com/blog/acf-6-1-8/
https://wordpress.org/plugins/advanced-custom-fields/
https://www.advancedcustomfields.com/
https://jvn.jp/en/jp/JVN98946408/
Impacted products
VendorProduct
WP EngineAdvanced Custom Fields
WP EngineAdvanced Custom Fields Pro
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:24:55.443Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.advancedcustomfields.com/blog/acf-6-1-8/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/advanced-custom-fields/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.advancedcustomfields.com/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN98946408/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Advanced Custom Fields",
          "vendor": "WP Engine",
          "versions": [
            {
              "status": "affected",
              "version": "versions 6.1.0 to 6.1.7"
            }
          ]
        },
        {
          "product": "Advanced Custom Fields Pro",
          "vendor": "WP Engine",
          "versions": [
            {
              "status": "affected",
              "version": "versions 6.1.0 to 6.1.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-21T08:13:50.271Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.advancedcustomfields.com/blog/acf-6-1-8/"
        },
        {
          "url": "https://wordpress.org/plugins/advanced-custom-fields/"
        },
        {
          "url": "https://www.advancedcustomfields.com/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN98946408/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-40068",
    "datePublished": "2023-08-21T08:13:50.271Z",
    "dateReserved": "2023-08-09T02:20:30.651Z",
    "dateUpdated": "2024-08-02T18:24:55.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-30777
Vulnerability from cvelistv5
Published
2023-05-10 05:50
Modified
2024-08-02 14:37
Severity
7.1 (High) - cvssV3_1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Summary
WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)
References
URLTags
https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cvevdb-entry
https://patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cvevdb-entry
https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites?_s_id=cvetechnical-description
Impacted products
VendorProduct
WP EngineAdvanced Custom Fields Pro
WP EngineAdvanced Custom Fields
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:37:15.173Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve"
          },
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve"
          },
          {
            "tags": [
              "technical-description",
              "x_transferred"
            ],
            "url": "https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites?_s_id=cve"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Custom Fields Pro",
          "vendor": "WP Engine",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.1.6",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.1.5",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "advanced-custom-fields",
          "product": "Advanced Custom Fields",
          "vendor": "WP Engine",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.1.6",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.1.5",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Rafie Muhammad (Patchstack)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins \u0026lt;=\u003cspan style=\"background-color: var(--wht);\"\u003e\u0026nbsp;6.1.5 versions.\u003c/span\u003e"
            }
          ],
          "value": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins \u003c=\u00a06.1.5 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-10T05:59:43.938Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve"
        },
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to\u0026nbsp;6.1.6 or a higher version."
            }
          ],
          "value": "Update to\u00a06.1.6 or a higher version."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins \u003c= 6.1.5 vulnerable to Cross Site Scripting (XSS)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2023-30777",
    "datePublished": "2023-05-10T05:50:04.023Z",
    "dateReserved": "2023-04-17T12:29:35.716Z",
    "dateUpdated": "2024-08-02T14:37:15.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-45429
Vulnerability from cvelistv5
Published
2024-09-04 23:07
Modified
2024-09-05 13:33
Severity
Summary
Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker's.
References
URLTags
https://www.advancedcustomfields.com/blog/acf-6-3-6/
https://wordpress.org/plugins/advanced-custom-fields/
https://www.advancedcustomfields.com/
https://jvn.jp/en/jp/JVN67963942/
Impacted products
VendorProduct
WP EngineAdvanced Custom Fields
WP EngineAdvanced Custom Fields Pro
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-05T13:33:40.928462Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-05T13:33:49.318Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Advanced Custom Fields",
          "vendor": "WP Engine",
          "versions": [
            {
              "status": "affected",
              "version": "6.3.5 and earlier"
            }
          ]
        },
        {
          "product": "Advanced Custom Fields Pro",
          "vendor": "WP Engine",
          "versions": [
            {
              "status": "affected",
              "version": "6.3.5 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the \u0027capability\u0027 setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker\u0027s."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-04T23:07:58.383Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.advancedcustomfields.com/blog/acf-6-3-6/"
        },
        {
          "url": "https://wordpress.org/plugins/advanced-custom-fields/"
        },
        {
          "url": "https://www.advancedcustomfields.com/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN67963942/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-45429",
    "datePublished": "2024-09-04T23:07:58.383Z",
    "dateReserved": "2024-08-29T00:56:56.778Z",
    "dateUpdated": "2024-09-05T13:33:49.318Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

jvndb-2024-000093
Vulnerability from jvndb
Published
2024-09-04 13:01
Modified
2024-09-04 13:01
Severity
5.4 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
WordPress Plugin "Advanced Custom Fields" vulnerable to cross-site scripting
Details
The field labels in WordPress Plugin "Advanced Custom Fields" provided by WP Engine contains a cross-site scripting vulnerability (CWE-79). Ryo Sotoyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
TypeURL
JVN https://jvn.jp/en/jp/JVN67963942/index.html
CVE https://www.cve.org/CVERecord?id=CVE-2024-45429
Cross-site Scripting(CWE-79) https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
Impacted products
VendorProduct
WP EngineAdvanced Custom Fields
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000093.html",
  "dc:date": "2024-09-04T13:01+09:00",
  "dcterms:issued": "2024-09-04T13:01+09:00",
  "dcterms:modified": "2024-09-04T13:01+09:00",
  "description": "The field labels in WordPress Plugin \"Advanced Custom Fields\" provided by WP Engine contains a cross-site scripting vulnerability (CWE-79).\r\n\r\nRyo Sotoyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000093.html",
  "sec:cpe": {
    "#text": "cpe:/a:advancedcustomfields:advanced_custom_fields",
    "@product": "Advanced Custom Fields",
    "@vendor": "WP Engine",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.4",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000093",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN67963942/index.html",
      "@id": "JVN#67963942",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-45429",
      "@id": "CVE-2024-45429",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "WordPress Plugin \"Advanced Custom Fields\" vulnerable to cross-site scripting"
}

jvndb-2023-000084
Vulnerability from jvndb
Published
2023-08-21 14:05
Modified
2024-03-25 17:55
Severity
5.4 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
WordPress Plugin "Advanced Custom Fields" vulnerable to cross-site scripting
Details
WordPress Plugin "Advanced Custom Fields" provided by WP Engine contains a cross-site scripting vulnerability (CWE-79). Ryotaro Imamura of SB Technology Corp. and Satoo Nakano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
TypeURL
JVN http://jvn.jp/en/jp/JVN98946408/index.html
CVE https://www.cve.org/CVERecord?id=CVE-2023-40068
NVD https://nvd.nist.gov/vuln/detail/CVE-2023-40068
Cross-site Scripting(CWE-79) https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
Impacted products
VendorProduct
WP EngineAdvanced Custom Fields
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000084.html",
  "dc:date": "2024-03-25T17:55+09:00",
  "dcterms:issued": "2023-08-21T14:05+09:00",
  "dcterms:modified": "2024-03-25T17:55+09:00",
  "description": "WordPress Plugin \"Advanced Custom Fields\" provided by WP Engine contains a cross-site scripting vulnerability (CWE-79).\r\n\r\nRyotaro Imamura of SB Technology Corp. and Satoo Nakano reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000084.html",
  "sec:cpe": {
    "#text": "cpe:/a:advancedcustomfields:advanced_custom_fields",
    "@product": "Advanced Custom Fields",
    "@vendor": "WP Engine",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "3.5",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.4",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000084",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN98946408/index.html",
      "@id": "JVN#98946408",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-40068",
      "@id": "CVE-2023-40068",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-40068",
      "@id": "CVE-2023-40068",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "WordPress Plugin \"Advanced Custom Fields\" vulnerable to cross-site scripting"
}