Description

The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.

Remediation

References

CVE-2021-24241

Related Vulnerabilities

WordPress Plugin Windsor Strava Athlete Unspecified Vulnerability (1.3.5)

phpList Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-23217)

Skipper : Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-54247)

PHP Improper Input Validation Vulnerability (CVE-2015-4604)

WordPress Plugin Import and export users and customers Multiple Vulnerabilities (1.9.4.6)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2021-24241