Description
The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of higher-privileged users who view the affected post-list screen.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Admin Columns for ACF Fields | ≤ 0.3.2 | — |
References
- https://wpscan.com/vulnerability/dea1f3a9-2681-47a6-9e36-9d6ea799decb/ exploit vdb-entry technical-description