UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2023-6701

Advanced Custom Fields (ACF®): Cross-site Scripting

Severity
Medium 5.4
Published
17 Jan 2024
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
6.2.5
Also known as
WPV-60b14f809e5c
Sources
NVD, WPVulnerability

Description

The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user…

Affected software

SoftwareAffected versions
Advanced Custom FieldsServers and applications · cpe:a:advancedcustomfields:advanced_custom_fields
  • Every version up to 6.2.4
Advanced Custom FieldsWordPress plugins · wp-plugin:advanced-custom-fields
  • Every version before 6.2.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-6701
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-6701
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/detail/advanced-custom-fields-624-authenticated-contributor-stored-cross-site-scripting-via-custom-field