CVSS 3.0
5.4 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2019-11871
The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- custom_field_suite_project:custom_field_suite
References
- https://blog.reddy.io/2019/05/30/xss-injection-vulnerability-in-custom-field-suite-wordpress-plugin/
- https://wordpress.org/plugins/custom-field-suite/#developers
- https://wpvulndb.com/vulnerabilities/9273
- https://blog.reddy.io/2019/05/30/xss-injection-vulnerability-in-custom-field-suite-wordpress-plugin/
- https://wordpress.org/plugins/custom-field-suite/#developers