CVE-2023-40068

Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.

• CWE-79

• https://jvn.jp/en/jp/JVN98946408/Third Party Advisory
• https://wordpress.org/plugins/advanced-custom-fields/Product
• https://www.advancedcustomfields.com/Product
• https://www.advancedcustomfields.com/blog/acf-6-1-8/Release Notes, Vendor Advisory
• https://jvn.jp/en/jp/JVN98946408/Third Party Advisory
• https://wordpress.org/plugins/advanced-custom-fields/Product
• https://www.advancedcustomfields.com/Product
• https://www.advancedcustomfields.com/blog/acf-6-1-8/Release Notes, Vendor Advisory

Published

Aug 21, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40058Sensitive data was added to our public-facing knowledgebase …6.5
• CVE-2023-4006Improper Neutralization of Formula Elements in a CSV File in…9.8
• CVE-2023-40060A vulnerability has been identified within Serv-U 15.4 and 1…7.2
• CVE-2023-40061 Insecure job execution mechanism vulnerability. This vulne…8.8
• CVE-2023-40062SolarWinds Platform Incomplete List of Disallowed Inputs Rem…8.8
• CVE-2023-40067Unchecked return value in firmware for some Intel(R) CSME ma…5.7
• CVE-2023-40069OS command injection vulnerability in ELECOM wireless LAN ro…9.8
• CVE-2023-4007Cross-site Scripting (XSS) - Stored in GitHub repository tho…5.4
• CVE-2023-40070Improper access control in some Intel(R) Power Gadget softwa…8.8
• CVE-2023-40071Improper access control in some Intel(R) GPA software instal…7.8
• CVE-2023-40072OS command injection vulnerability in ELECOM wireless LAN ac…8.8
• CVE-2023-40073In visitUris of Notification.java, there is a possible cross…5.5