QID 730813

Advanced Custom Fields (ACF) is a powerful and popular WordPress plugin. With ACF, users can easily create custom fields, add metadata, and manipulate data, allowing for more complex and customizable websites.

The plugin has been found to have a vulnerability that can potentially allow Reflected Cross-Site Scripting (XSS) attacks. The vulnerability is caused by insufficient input sanitization and output escaping of the 'post_status' parameter. If successfully exploited, attackers can inject arbitrary web scripts that execute when a user performs a specific action, such as clicking on a malicious link. It is important to note that this vulnerability can be exploited without authentication, making it particularly dangerous for WordPress site owners.

Affected versions:
Advanced Custom Fields plugin versions 6.1.5 and below

QID Detection Logic :
This unauthenticated detection depends on the BlindElephant engine to detect the vulnerable version of the Advanced Custom Fields WordPress plugin.

Successful exploitation could allow an attacker to execute arbitrary JavaScript code in the context of the interface or allow the attacker to access sensitive, browser-based information.