New Vulnerability in Popular WordPress Plugin Exposes Over 2 Million Sites to Cyberattacks

Advanced Custom Fields plugin for WordPress has discovered a security flaw that requires users to update to version 6.1.6.

The vulnerability (CVE-2023-30777) is a case of reflected cross-site scripting (XSS), allowing the injection of arbitrary executable scripts into benign websites. This could lead to privilege escalation on the WordPress site, enabling any unauthenticated user to steal sensitive information. The free and pro versions of the plugin both have over two million active installations.

The reflected XSS attack takes place when …

advanced advanced custom fields plugin case cross-site cve cyberattacks cybersecurity escalation flaw injection plugin popular privilege privilege escalation scripting scripts security update version vulnerability websites wordpress wordpress plugin xss