Medium severity6.1NVD Advisory· Published Apr 22, 2021· Updated Jun 17, 2026

CVE-2021-24241

Description

The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Advanced Custom Fields Pro plugindescription
Advancedcustomfields/Advanced Custom Fieldsllm-fuzzy
Range: <5.9.1
WordPress/Advanced Custom Fields Prollm-fuzzy
Range: <5.9.1
Package: https://wordpress.org/plugins/advanced-custom-fields-pro

Patches

Vulnerability mechanics

References

github.com/jdordonezn/Reflected-XSS-in-WordPress-for-ACF-PRO-before-5.9.1-plugin/issues/1nvdExploitThird Party Advisory
wpscan.com/vulnerability/d1e9c995-37bd-4952-b88e-945e02e3c83fnvdExploitThird Party Advisory
www.advancedcustomfields.com/blog/acf-5-9-1-release/nvdRelease NotesVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000