CVE-2021-24241CWE-79

Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)

published April 22, 2021

CVSS
—
EPSS
1%
Percentile
72.0
In the wild
Unconfirmed
What it is

The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01387 · 72.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-04-22T21:00Z
EPSS history
Timeline
  • 22 APR 21:00Z
    Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)
    cvelistv5