Description
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.
Remediation
References
Related Vulnerabilities
WordPress Plugin Duplicator-WordPress Migration Arbitrary File Download (1.3.26)
WordPress 4.1.x Multiple Vulnerabilities (4.1 - 4.1.31)
OpenSSL Out-of-bounds Write Vulnerability (CVE-2025-69419)
WordPress Plugin WP Google Maps SQL Injection (7.11.17)
WordPress Plugin Child Themes Helper Multiple Vulnerabilities (2.0)