Vulnerabilities

TI-2023-24407 CVE-2023-45604 · GHSA-v3qf-4pxv-m9xf

WordPress Get Custom Field Values Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Scott Reilly Get Custom Field Values plugin <= 4.0.1 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-10-18 No fix listed CWE-79

TI-2021-07154 CVE-2021-24872 · GHSA-72q7-8432-wmmm

Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access

LOW 31

The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01028 Published 2021-12-13 Fixed in 4.0 CWE-863

TI-2021-07153 CVE-2021-24871 · GHSA-xvr9-h38m-rc5q

Get Custom Field Values < 4.0.1 - Contributor+ Stored Cross-Site Scripting

LOW 26

The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attack…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00707 Published 2021-12-13 Fixed in 4.0.1 CWE-79

Vulnerabilities

Filters

WordPress Get Custom Field Values Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)

Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access

Get Custom Field Values < 4.0.1 - Contributor+ Stored Cross-Site Scripting