/Vulnerability Library

Custom Field Manager WordPress - Cross-Site Scripting

CVE-2024-12873
Verified

Description

Custom Field Manager WordPress plugin through 1.0 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request.

Severity

Medium

CVSS Score

6.1

Exploit Probability

1%

Affected Product

custom_field_manager

Published Date

February 6, 2026

Template Author

sourabh-sahu

CVE-2024-12873.yaml
6.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2024-12873
CWE ID:
cwe-79

References

https://wpscan.com/vulnerability/3e82d45f-7b8f-424e-a8d7-be64f5acf65e/https://nvd.nist.gov/vuln/detail/CVE-2024-12873

Remediation Steps

Update to the latest version with proper sanitization and escaping.