cveboard RSS feed

CVE-2024-45429

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2024
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker's.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Advanced Custom Fields

Vendor
WP Engine
Product
Advanced Custom Fields
Platforms
Unknown
Default status
Unknown
Advanced Custom Fields · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
6.3.5 and earlieraffectedUnavailableUnavailableUnavailableNone listed

Advanced Custom Fields Pro

Vendor
WP Engine
Product
Advanced Custom Fields Pro
Platforms
Unknown
Default status
Unknown
Advanced Custom Fields Pro · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
6.3.5 and earlieraffectedUnavailableUnavailableUnavailableNone listed