CVE-2023-30777

HighPublished

WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)

Published: May 10, 2023
Updated: Apr 28, 2026
Assigning CNA: Patchstack
Evidence observed: Aug 8, 2026

Primary CVSS

7.1/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS probability estimate

39.0%

Moderate · next 30 days

Percentile: 98.6%
Model date: Oct 17, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

Advanced Custom Fields < 6.1.6 - Cross-Site ScriptingTemplate
http/cves/2023/CVE-2023-30777.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 008731b339bdRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)

CVE-2023-30777PoC
Proof of Concept (PoC) URL generator for a reflected XSS vulnerability in the Advanced Custom Fields WordPress plugin.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.