CVE-2021-24241

Description

The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.

Weakness classification

• contact@wpscan.com: CWE-79

Primary references

• contact@wpscan.com — Exploit, Third Party Advisory
• contact@wpscan.com — Exploit, Third Party Advisory
• contact@wpscan.com — Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory