Advanced Custom Fields (ACF®) <= 6.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Field Wrapper Attributes and Custom Choice Values
- ID
- WPSEC-2026-2421
- Plugin
- Advanced Custom Fields (ACF®) (advanced-custom-fields)
- Affected
- all versions before 6.8.11
- Remediation
- Update to 6.8.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Advanced Custom Fields (ACF®) on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom values submitted to Checkbox, Radio and Select fields with "Save Custom Values" enabled in all versions up to, and including, 6.8.10. This is due to the plugin adding submitted values to the field's choices and saving the serialized field settings through wp_update_post(), where kses filtering for users without the unfiltered_html capability changes string lengths and corrupts the serialized data, combined with wrapper attribute names (including on* event handlers) being output without validation. This makes it possible for authenticated attackers with contributor-level access and above, who can submit values to such a field, to inject arbitrary HTML attributes and web scripts into the field's wrapper that execute whenever a user accesses a page where the field is rendered.
References
- https://wpsec.com/vuln/WPSEC-2026-2421/
- https://plugins.svn.wordpress.org/advanced-custom-fields/tags/6.8.11/
- https://wordpress.org/plugins/advanced-custom-fields/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS