UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2023-40068

Advanced Custom Fields (ACF®): Cross-site Scripting

Severity
Medium 5.4
Published
3 Aug 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Also known as
WPV-d2abda661382
Sources
NVD, WPVulnerability

Description

Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.

Affected software

SoftwareAffected versions
Advanced Custom FieldsServers and applications · cpe:a:advancedcustomfields:advanced_custom_fields
  • From 6.1.0 up to 6.1.7
Advanced Custom FieldsWordPress plugins · wp-plugin:advanced-custom-fields
  • From 6.1.0 up to 6.1.7

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-40068
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-40068
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-custom-fields/advanced-custom-fields-617-authenticated-administrator-stored-cross-site-scripting