CVE-2021-24241: Advancedcustomfields Advanced Custom Fields

Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days.

The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.

Affected products

• Advancedcustomfields Advanced Custom Fields: before 5.9.1 (fixed in 5.9.1)

Published 2021-04-22. Last modified 2026-06-17.