CVE-2023-30777

HIGHNuclei

WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-30777 has a selected CVSS score of 7.1 (high); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · May 11, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 9, 2025 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

Advanced Custom Fields

Browse WP Engine / Advanced Custom Fields

Default status: unaffected

CVE ListThrough 6.1.5affected

Advanced Custom Fields Pro

Browse WP Engine / Advanced Custom Fields Pro

Default status: unaffected

CVE ListThrough 6.1.5affected

advanced_custom_fields

Browse advancedcustomfields / advanced_custom_fields
VulnCheckVersion data not supplied

Proofs of concept

1

Repository PoCs

GitHubAlucard0x1/CVE-2023-30777Repository PoCby Alucard0x18Not analyzed2 files

919 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMAdvanced Custom Fields < 6.1.6 - Cross-Site ScriptingCVSS 6.1

Advanced Custom Fields beofre 6.1.6 is susceptible to cross-site scripting via the post_status parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of a victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Fixed in version 6.1.6.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscve2023cvewpscanadvance-custom-fieldwpwp-pluginwordpressauthenticatedxssadvancedcustomfieldsvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:advancedcustomfields:advanced_custom_fields:*:*:*:*:-:wordpress:*:*
https://wpscan.com/vulnerability/95ded80f-a47b-411e-bd17-050439bf565f https://wordpress.org/plugins/advanced-custom-fields/advanced/ https://nvd.nist.gov/vuln/detail/CVE-2023-30777 https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve https://patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

Source: ProjectDiscovery

References

4