QID 150684

Advanced Custom Fields (ACF) is a powerful and popular WordPress plugin. With ACF, users can easily create custom fields, add metadata, and manipulate data, allowing for more complex and customizable websites.

The plugin has been found to have a vulnerability that can potentially allow Reflected Cross-Site Scripting (XSS) attacks. The vulnerability is caused by insufficient input sanitization and output escaping of the 'post_status' parameter. If successfully exploited, attackers can inject arbitrary web scripts that execute when a user performs a specific action, such as clicking on a malicious link. It is important to note that this vulnerability can be exploited without authentication, making it particularly dangerous for WordPress site owners.

Affected versions:
Advanced Custom Fields plugin versions 6.1.5 and below

QID Detection Logic :
This QID sends an HTTP GET request and retrieves a vulnerable version of a plugin running on the target application.

Successful exploitation could allow an attacker to execute arbitrary JavaScript code in the context of the interface or allow the attacker to access sensitive, browser-based information.