A flaw in two WordPress custom plug-ins leaves users vulnerable to cross-site scripting attacks (XSS), according to a recent report.
Patchstack researcher Rafie Muhammad recently discovered an XSS flaw in the Advanced Custom Fields and Advanced Custom Fields Pro plug-ins, which are actively installed by over 2 million users worldwide, according to Bleeping Computer.
The flaw, called CVE-2023-30777 was discovered on May 2 and was given a high-severity prominence. The plug-ins’ developer, WP Engine, quickly provided a security update, version 6.1.6, within days of learning about the vulnerability,on May 4.
The popular custom field builders allow users to have full control of their content management system from the back end, with WordPress edit screens, custom field data, and other features.
However, XSS bugs can be seen in a front-facing fashion and work by injecting “malicious scripts on websites viewed by others, resulting in the execution of code on the visitor’s web browser,” Bleeping Computer added.
This could leave website visitors open to having their data stolen from infected WordPress sites, Patchstack noted.
Specifics about the XSS vulnerability indicate that it might be triggered by a “default installation or configuration of the Advanced Custom Fields plug-in.” However, users would have to have logged-in access to the Advanced Custom Fields plug-in to trigger it in the first place, meaning a bad actor would have to trick someone with access to trigger the flaw, the researchers added.
The CVE-2023-30777 flaw can be found in the admin_body_class function handler, in which a bad actor can inject malicious code. In particular, this bug injects DOM XSS payloads into the improperly drafted code, which is not caught by the code’s sanitize output, a security measure of sorts, which is part of the flaw.
The fix on version 6.1.6 introduced the admin_body_class hook, which blocks the XSS attack from being able to execute.
Users of Advanced Custom Fields and Advanced Custom Fields Pro should upgrade the plug-ins to version 6.1.6 or later. Many users remain susceptible to attack, with approximately 72.1% of WordPress.org plug-in users having versions running below 6.1. This makes their websites vulnerable not only to XSS attacks but also to other flaws in the wild, the publication said.
ASUS has started selling its UGen Intel Arc Pro B70 graphics card in Europe, bringing its take on Intel’s workstation GPU to customers with a hefty €1,799 recommended price. The card is available in Germany and Austria, while ASUS lists it at CHF 1,799 in Switzerland.
Intel first introduced the Arc Pro B70 in March 2026, with its own branded model starting at $949. ASUS’s version arrives several months later with the same core GPU architecture but a different cooling design and a higher power rating. The price also places it well above Intel’s original starting point, although the two prices are not directly comparable because ASUS’s European figure includes VAT.
Anthropic has officially filed to go public, and buried inside its S-1 is a blunt warning about the technology at the center of its business. The maker of Claude AI says advanced AI could cause everything from large-scale cyberattacks and geopolitical instability to catastrophic or even existential risks for humanity.
The warnings take up a surprisingly large part of the filing. Axios notes that more than 90 pages, or roughly a third of the prospectus, focus on risk factors. Many of them warn about what could happen as AI systems become more capable and autonomous.
AI giants have a growing autonomy problem on their hands. A new Axios report has revealed that Anthropic's Claude recently accessed publicly available Georgia vote count without human authorization, sparking fresh concerns about AI security ahead of the upcoming midterm elections.