CVE-2024-0689: medium-severity vulnerability in mgibbs189 Custom Field Suite
Custom Field Suite <= 2.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.4epss 0.3%
The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a meta import in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on the meta values. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Affected products
mgibbs189 · Custom Field SuiteRelated CVEs — mgibbs189 Custom Field Suite
In the same product, most dangerous first.
CVE-2024-3562HIGHCustom Field Suite <= 2.6.7 - Authenticated (Contributor+) PHP Code Injection via Loop Custom FieldEPSS 0.6%CVE-2024-3068MEDIUMCustom Field Suite <= 2.6.5 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-3561HIGHCustom Field Suite <= 2.6.7 - Authenticated (Contributor+) SQL Injection via Term Custom FieldEPSS 0.5%CVE-2024-3558MEDIUMCustom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title]EPSS 0.4%CVE-2024-3559MEDIUMCustom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_content]EPSS 0.3%