← Vulnerability feed

Vulnerability record · CVE-2023-30777 · published 10 May 2023

CVE-2023-30777: Advancedcustomfields advanced custom fields cross-site scripting vulnerability

Advancedcustomfields · Advanced Custom Fields

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.

6.1 CVSS 3.1 Medium EPSS 39% · top 1.5% CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score
39%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites?_s_id=cve ExploitThird Party Advisory
https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-1 Third Party Advisory
https://patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-6-1-5-refle Third Party Advisory
https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites?_s_id=cve ExploitThird Party Advisory
https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-1 Third Party Advisory
https://patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-6-1-5-refle Third Party Advisory

Track CVE-2023-30777 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2023-1196Advancedcustomfields advanced custom fields deserialization of untrusted data vulnerabilityThe Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which coul…EPSS 1.1%8.8CVE-2022-2594Advancedcustomfields advanced custom fields unrestricted file upload vulnerabilityThe Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to …EPSS 1.6%7.5CVE-2022-40696Advancedcustomfields advanced custom fields information exposure vulnerabilityExposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom…EPSS 0.52%7.5CVE-2021-20865Advancedcustomfields advanced custom fields missing authorization vulnerabilityAdvanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in …EPSS 2.5%6.6CVE-2024-9529Advancedcustomfields advanced custom fields vulnerabilityThe Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress pl…EPSS 0.43%6.5CVE-2024-4565Advancedcustomfields advanced custom fields vulnerabilityThe Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom fie…EPSS 0.43%6.5CVE-2022-23183Advancedcustomfields advanced custom fields missing authorization vulnerabilityMissing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows…EPSS 1.5%6.5CVE-2021-20867Advancedcustomfields advanced custom fields missing authorization vulnerabilityAdvanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in …EPSS 1.4%

Source: NIST National Vulnerability Database (record CVE-2023-30777), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.