CVE-2024-3558

The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_title]' parameter versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
Link Resource
https://core.trac.wordpress.org/ticket/56655 Issue Tracking
https://en-gb.wordpress.org/plugins/custom-field-suite/ Product
https://github.com/WordPress/WordPress/blob/22d95abc55824e83904dc0fef290464b6bec7708/wp-admin/includes/template.php#L1384 Product
https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/api.php#L282 Product
https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/field_group.php#L20 Product
https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/form.php#L64 Product
https://mgibbs189.github.io/custom-field-suite/ Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4dc6fd-4bd5-4ed1-ade0-cf2f8831fac3?source=cve Third Party Advisory
https://core.trac.wordpress.org/ticket/56655 Issue Tracking
https://en-gb.wordpress.org/plugins/custom-field-suite/ Product
https://github.com/WordPress/WordPress/blob/22d95abc55824e83904dc0fef290464b6bec7708/wp-admin/includes/template.php#L1384 Product
https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/api.php#L282 Product
https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/field_group.php#L20 Product
https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/form.php#L64 Product
https://mgibbs189.github.io/custom-field-suite/ Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4dc6fd-4bd5-4ed1-ade0-cf2f8831fac3?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:custom_field_suite_project:custom_field_suite:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 09:29

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.4
v2 : unknown
v3 : 6.4
References () https://core.trac.wordpress.org/ticket/56655 - Issue Tracking () https://core.trac.wordpress.org/ticket/56655 - Issue Tracking
References () https://en-gb.wordpress.org/plugins/custom-field-suite/ - Product () https://en-gb.wordpress.org/plugins/custom-field-suite/ - Product
References () https://github.com/WordPress/WordPress/blob/22d95abc55824e83904dc0fef290464b6bec7708/wp-admin/includes/template.php#L1384 - Product () https://github.com/WordPress/WordPress/blob/22d95abc55824e83904dc0fef290464b6bec7708/wp-admin/includes/template.php#L1384 - Product
References () https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/api.php#L282 - Product () https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/api.php#L282 - Product
References () https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/field_group.php#L20 - Product () https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/field_group.php#L20 - Product
References () https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/form.php#L64 - Product () https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/form.php#L64 - Product
References () https://mgibbs189.github.io/custom-field-suite/ - Exploit () https://mgibbs189.github.io/custom-field-suite/ - Exploit
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4dc6fd-4bd5-4ed1-ade0-cf2f8831fac3?source=cve - Third Party Advisory () https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4dc6fd-4bd5-4ed1-ade0-cf2f8831fac3?source=cve - Third Party Advisory

11 Jul 2024, 02:52

Type Values Removed Values Added
CPE cpe:2.3:a:custom_field_suite_project:custom_field_suite:*:*:*:*:*:wordpress:*:*
CVSS v2 : unknown
v3 : 6.4
v2 : unknown
v3 : 5.4
First Time Custom Field Suite Project
Custom Field Suite Project custom Field Suite
References () https://core.trac.wordpress.org/ticket/56655 - () https://core.trac.wordpress.org/ticket/56655 - Issue Tracking
References () https://en-gb.wordpress.org/plugins/custom-field-suite/ - () https://en-gb.wordpress.org/plugins/custom-field-suite/ - Product
References () https://github.com/WordPress/WordPress/blob/22d95abc55824e83904dc0fef290464b6bec7708/wp-admin/includes/template.php#L1384 - () https://github.com/WordPress/WordPress/blob/22d95abc55824e83904dc0fef290464b6bec7708/wp-admin/includes/template.php#L1384 - Product
References () https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/api.php#L282 - () https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/api.php#L282 - Product
References () https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/field_group.php#L20 - () https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/field_group.php#L20 - Product
References () https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/form.php#L64 - () https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/form.php#L64 - Product
References () https://mgibbs189.github.io/custom-field-suite/ - () https://mgibbs189.github.io/custom-field-suite/ - Exploit
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4dc6fd-4bd5-4ed1-ade0-cf2f8831fac3?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4dc6fd-4bd5-4ed1-ade0-cf2f8831fac3?source=cve - Third Party Advisory
CWE CWE-79

20 Jun 2024, 12:43

Type Values Removed Values Added
Summary
  • (es) El complemento Custom Field Suite para WordPress es vulnerable a Cross-Site Scripting Almacenado a través de las versiones del parámetro 'cfs[post_title]' hasta la 2.6.7 incluida debido a una sanitización de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada.

20 Jun 2024, 02:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-06-20 02:15

Updated : 2024-11-21 09:29


NVD link : CVE-2024-3558

Mitre link : CVE-2024-3558

CVE.ORG link : CVE-2024-3558


JSON object : View

Products Affected

custom_field_suite_project

  • custom_field_suite
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')