CVE-2023-40068
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
A cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with administrative privileges.
Risk Assessment
An attacker could exploit this vulnerability to hijack user sessions or steal data, posing a significant security risk to the system.
Recommendation
It is recommended to update the Advanced Custom Fields and Advanced Custom Fields Pro plugins to the latest version to mitigate this vulnerability.
Original NVD description (English source)
Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.