Advanced Views Display Framework Gutenberg Elementor Shortcode
Monthly
Stored cross-site scripting in the Advanced Views - Display Framework - Gutenberg/Elementor/Shortcode plugin (acf-views) for WordPress, affecting all versions up to and including 3.9.6, allows unauthenticated visitors to plant script payloads through the public 'comment' parameter that later execute in the browser of anyone loading a page where an avf-layout block renders that comment's content. The decisive weakness is that the plugin's get_comment() lookup applies no approval-status filter, so a pending or unapproved comment is enough to trigger the payload - ordinary comment moderation does not mitigate the attack. Severity is rated CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, CWE-79) with a this_week priority label; no public exploit code and no CISA KEV entry were identified at time of analysis.
Stored cross-site scripting in the Advanced Views - Display Framework - Gutenberg/Elementor/Shortcode plugin (acf-views) for WordPress, affecting all versions up to and including 3.9.6, allows unauthenticated visitors to plant script payloads through the public 'comment' parameter that later execute in the browser of anyone loading a page where an avf-layout block renders that comment's content. The decisive weakness is that the plugin's get_comment() lookup applies no approval-status filter, so a pending or unapproved comment is enough to trigger the payload - ordinary comment moderation does not mitigate the attack. Severity is rated CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, CWE-79) with a this_week priority label; no public exploit code and no CISA KEV entry were identified at time of analysis.