jvn.jp
https://jvn.jp/en/jp/JVN98946408 CVE-2023-40068
MEDIUM
Record summary
CVE-2023-40068 has a selected CVSS score of 5.4 (medium).
Description
Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 4, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Advanced Custom FieldsBrowse WP Engine / Advanced Custom Fields | CVE List | versions 6.1.0 to 6.1.7 | affected |
Advanced Custom Fields ProBrowse WP Engine / Advanced Custom Fields Pro | CVE List | versions 6.1.0 to 6.1.7 | affected |
References
5nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-40068 wordpress.org
https://wordpress.org/plugins/advanced-custom-fields advancedcustomfields.com
https://www.advancedcustomfields.com/ advancedcustomfields.com
https://www.advancedcustomfields.com/blog/acf-6-1-8