CVE-2025-54940_CVE-2025-54940

4.6 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Description

An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered.

AI Analysis

An HTML injection vulnerability in the WordPress plugin 'Advanced Custom Fields' prior to version 6.4.3 allows attackers to inject HTML code, potentially altering webpage content.

Basic Information

ID CVE-2025-54940

Source jpcert

Published Aug 8, 2025 at 04:34

Affected Product

Vendor WPEngine, Inc.

Product Advanced Custom Fields

Version prior to 6.4.3

Affected Versions WPEngine, Inc. Advanced Custom Fields prior to 6.4.3

CWE Classification

CWE-94

AI Assessment

AI Severity Medium

Vendor WordPress Community

Product Advanced Custom Fields

Version 6.4.3

References

{
    "lastseen": "",
    "description": "An HTML injection vulnerability exists in WordPress plugin \"Advanced Custom Fields\" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered.",
    "published": "2025-08-08T04:34:02.380Z",
    "modified": "2025-08-08T04:34:02.380Z",
    "type": "cve",
    "title": "CVE-2025-54940",
    "source": "jpcert",
    "references": "https://www.advancedcustomfields.com/blog/acf-6-4-3-security-release/\nhttps://jvn.jp/en/jp/JVN21048820/",
    "id": "CVE-2025-54940",
    "bulletinFamily": "",
    "cwe": [
        "CWE-94"
    ],
    "cvelist": null,
    "sourceData": "WPEngine, Inc. Advanced Custom Fields prior to 6.4.3",
    "sourceHref": "",
    "cvss": {
        "score": 4.6,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Advanced Custom Fields",
    "version": "prior to 6.4.3",
    "vendor": "WPEngine, Inc.",
    "ai_description": "An HTML injection vulnerability in the WordPress plugin 'Advanced Custom Fields' prior to version 6.4.3 allows attackers to inject HTML code, potentially altering webpage content.",
    "ai_severity": "Medium",
    "ai_vendor": "WordPress Community",
    "ai_product": "Advanced Custom Fields",
    "ai_version": "6.4.3",
    "ai_score": 0
}