CVE-2023-30777highexploração observadaCWE-79

CVE-2023-30777: falha de alta gravidade em WP Engine Advanced Custom Fields

WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)

Publicada em 10 mai 2023 · Atualizada em 28 abr 2026

Seguir esta CVE + Monitorar Advanced Custom Fields + Monitorar Advanced Custom Fields PRO

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

90Vexday Risk Score

Corrija agora. Ela exploração observada na prática e tem exploit funcional público.

ssvc Actcvss 7.1epss 39%

da publicação à arma38 dias

Publicada no NVD10 de mai.

1ª PoC+38d

Exploração observada+1d

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Produtos afetados

WP Engine · Advanced Custom Fields WP Engine · Advanced Custom Fields Pro

CVEs relacionadas — WP Engine Advanced Custom Fields

No mesmo produto, das mais perigosas para as menos.

CVE-2023-40068—CVE-2023-40068EPSS 2.0%CVE-2024-45429MEDIUMCVE-2024-45429EPSS 0.4%

Referências

https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites?_s_id=cve https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve https://patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve