CVE-2021-24241: vulnerability in Advanced Custom Fields Pro
Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.4%
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.
Affected products
Unknown · Advanced Custom Fields ProRelated CVEs — Advanced Custom Fields Pro
In the same product, most dangerous first.