CVE-2025-54940

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered.

Metrics

CVSS 4.0 4.6/10CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Aug 8, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-549414.6An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server anCVE-2025-549429.8A missing authentication for critical function vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attacCVE-2025-549439.8A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthoCVE-2025-549449.8An unrestricted upload of file with dangerous type vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote aCVE-2025-549459.8An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers tCVE-2025-549469.8A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL cCVE-2025-549479.8In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerabilityCVE-2025-549489.8A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious CVE-2025-549499.8A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effecCVE-2025-54959.8A vulnerability was found in Netgear WNR614 1.1.0.28_1.0.1WW. It has been classified as critical. This affects an unknown part of the componCVE-2025-549509.8An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execCVE-2025-549519.8A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result