Description

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T06:16:39.717Z",
  "pubdate": "2026-11-06T06:16:39.717Z",
  "executiveSummary": "The Advanced Custom Fields (ACF) WordPress plugin prior to version 6.8.11 contains a critical Stored Cross-Site Scripting (XSS) vulnerability. The flaw originates from improper input sanitization within the plugin's field definition handling process, specifically via comment-related operations.\nThis vulnerability allows unauthenticated, remote attackers to inject malicious JavaScript payloads directly into the application's database. When a site administrator or a regular visitor interacts with a page rendering the compromised field definition, the injected payload is executed within the context of the user's browser session.\nThe impact is significant, as successful exploitation may lead to administrative account takeover, unauthorized administrative actions, sensitive data exfiltration, or the deployment of secondary malicious scripts. The vulnerability does not require authentication or elevated privileges, making it accessible to any network-adjacent attacker. Users are advised to upgrade to version 6.8.11 or later immediately to mitigate the risk of unauthorized code execution.",
  "technicalDetails": "The vulnerability resides in the plugin's field definition management logic. Specifically, the component responsible for processing field definitions fails to adequately sanitize inputs routed through the comment handling system. This oversight allows an attacker to bypass security filters and inject arbitrary characters into the stored configuration data.\nThe root cause is a failure to properly escape or sanitize data before it is rendered as an HTML attribute name. When a field definition is stored in the WordPress database, the plugin processes it in a manner that persists the malicious input. Upon the rendering of an affected field on the frontend or within the WordPress dashboard, the application emits the contaminated definition into the Document Object Model (DOM).\nBecause the input is reflected within an HTML attribute, an attacker can escape the intended attribute context by injecting quote characters (e.g., ' or \"), followed by a JavaScript event handler such as 'onmouseover' or 'onerror'. This effectively transforms the malicious string into executable client-side code.\nThe attack flow proceeds as follows: 1. The attacker identifies the target field definition endpoint or the relevant comment-based input mechanism used to manipulate ACF configurations. 2. The attacker crafts a payload designed to break out of the HTML attribute and execute arbitrary JavaScript. 3. The attacker submits the payload, which is saved into the database without sufficient sanitization. 4. An authenticated administrator or a standard visitor views the page where the field is rendered. 5. The browser interprets the injected attribute, triggering the malicious script execution in the context of the victim's session.\nSince the payload is stored, this is a persistent attack vector. The browser executes the injected JavaScript with the victim's permissions, which, in the case of a WordPress administrator, grants the attacker the ability to perform any action the administrator can perform, including the creation of new administrator accounts or the injection of backdoors into the theme files. The lack of authentication requirements for the initial injection renders the plugin highly susceptible to automated exploitation efforts over the network."
}