Advanced Custom Fields: Font Awesome Field <= 6.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Font Awesome Icon Field Value
- ID
- WPSEC-2026-2809
- Plugin
- Advanced Custom Fields: Font Awesome Field (advanced-custom-fields-font-awesome)
- Affected
- from 4.0.0 before 6.2.1
- Remediation
- Update to 6.2.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- Advanced Custom Fields: Font Awesome Field on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Custom Fields: Font Awesome Field plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Font Awesome icon field value in all versions up to, and including, 6.2.0, due to insufficient input sanitization and output escaping of the user-supplied icon JSON (such as the unicode, id, style, family, path and SVG html properties, as well as legacy class strings) when it is saved and formatted, particularly through the 'Icon Object' and 'Unicode' return formats. This makes it possible for authenticated attackers who can save a Font Awesome icon field, with Subscriber-level access and above where such a field is shown on the user profile form, or Contributor-level access and above where it is attached to posts, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the icon.
References
- https://wpsec.com/vuln/WPSEC-2026-2809/
- https://plugins.svn.wordpress.org/advanced-custom-fields-font-awesome/tags/6.2.1/
- https://wordpress.org/plugins/advanced-custom-fields-font-awesome/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS