PT-2019-12532 · WordPress · Custom Field Suite

Published 2019-05-10 · Updated 2019-06-17 · CVE-2019-11871

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Custom Field Suite plugin versions prior to 2.5.15

Description The issue allows for cross-site scripting (XSS) attacks, potentially affecting editors or administrators.

Recommendations For versions prior to 2.5.15, update to version 2.5.15 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-11871

Affected Products

Custom Field Suite

References · 5

• https://osv.dev/vulnerability/CVE-2019-11871 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11871 · Security Note
• https://wpvulndb.com/vulnerabilities/9273 · Note
• https://blog.reddy.io/2019/05/30/xss-injection-vulnerability-in-custom-field-suite-wordpress-plugin · Note
• https://wordpress.org/plugins/custom-field-suite/#developers · Note