Millions of WordPress-powered websites are using the Advanced Custom Fields and Advanced Custom Fields Pro plugins, which security researchers say have been vulnerable to cross-site scripting (XSS) attacks. The high severity vulnerability could have allowed a malicious hacker to inject malicious scripts, such as redirects, adverts, and other HTML content into website that would execute when users visited the targeted website.

Read full article on Graham Cluley