The Field Group editor renders each field’s label into the field list without escaping it, so a field label containing HTML markup is executed as script in the browser of any administrator who opens or edits that field group. The fix HTML-escapes the label before it is rendered.
This vulnerability affects the following application versions:
- Advanced Custom Fields (ACF) 5.9.0
- Advanced Custom Fields (ACF) 5.9.1
- Advanced Custom Fields (ACF) 5.9.2
- Advanced Custom Fields (ACF) 5.9.3
- Advanced Custom Fields (ACF) 5.9.4
- Advanced Custom Fields (ACF) 5.9.5
- Advanced Custom Fields (ACF) 5.9.6
- Advanced Custom Fields (ACF) 5.9.7
- Advanced Custom Fields (ACF) 5.9.8
- Advanced Custom Fields (ACF) 5.9.9
- Advanced Custom Fields (ACF) 5.10
- Advanced Custom Fields (ACF) 5.10.1
- Advanced Custom Fields (ACF) 5.10.2
- Advanced Custom Fields (ACF) 5.11
- Advanced Custom Fields (ACF) 5.11.1
- Advanced Custom Fields (ACF) 5.11.2
- Advanced Custom Fields (ACF) 5.11.3
- Advanced Custom Fields (ACF) 5.11.4
- Advanced Custom Fields (ACF) 5.12
- Advanced Custom Fields (ACF) 5.12.1
- Advanced Custom Fields (ACF) 5.12.2
- Advanced Custom Fields (ACF) 5.12.3
- Advanced Custom Fields (ACF) 5.12.4
- Advanced Custom Fields (ACF) 5.12.5
- Advanced Custom Fields (ACF) 5.12.6
- Advanced Custom Fields (ACF) 6.0.0
- Advanced Custom Fields (ACF) 6.0.1
- Advanced Custom Fields (ACF) 6.0.2
- Advanced Custom Fields (ACF) 6.0.3
- Advanced Custom Fields (ACF) 6.0.4
- Advanced Custom Fields (ACF) 6.0.5
- Advanced Custom Fields (ACF) 6.0.6
- Advanced Custom Fields (ACF) 6.0.7
- Advanced Custom Fields (ACF) 6.1.0
- Advanced Custom Fields (ACF) 6.1.1
- Advanced Custom Fields (ACF) 6.1.2
- Advanced Custom Fields (ACF) 6.1.3
- Advanced Custom Fields (ACF) 6.1.4
- Advanced Custom Fields (ACF) 6.1.5
- Advanced Custom Fields (ACF) 6.1.6
- Advanced Custom Fields (ACF) 6.1.7
- Advanced Custom Fields (ACF) 6.1.8
- Advanced Custom Fields (ACF) 6.2.0
- Advanced Custom Fields (ACF) 6.2.1
- Advanced Custom Fields (ACF) 6.2.2
- Advanced Custom Fields (ACF) 6.2.3
- Advanced Custom Fields (ACF) 6.2.4
- Advanced Custom Fields (ACF) 6.2.5
- Advanced Custom Fields (ACF) 6.2.6
- Advanced Custom Fields (ACF) 6.2.6.1
- Advanced Custom Fields (ACF) 6.2.7
- Advanced Custom Fields (ACF) 6.2.8
- Advanced Custom Fields (ACF) 6.2.9
- Advanced Custom Fields (ACF) 6.3.0
- Advanced Custom Fields (ACF) 6.3.1
- Advanced Custom Fields (ACF) 6.3.2
- Advanced Custom Fields (ACF) 6.3.3
- Advanced Custom Fields (ACF) 6.3.4
- Advanced Custom Fields (ACF) 6.3.5
- Advanced Custom Fields (ACF) 6.3.6
- Advanced Custom Fields (ACF) 6.3.6.1
- Advanced Custom Fields (ACF) 6.3.6.2
- Advanced Custom Fields (ACF) 6.3.6.3
- Advanced Custom Fields (ACF) 6.3.9
- Advanced Custom Fields (ACF) 6.3.10.2