# Advanced Custom Fields: Font Awesome Field <= 6.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Font Awesome Icon Field Value

- **ID:** WPSEC-2026-2809
- **Plugin:** Advanced Custom Fields: Font Awesome Field (`advanced-custom-fields-font-awesome`), https://wordpress.org/plugins/advanced-custom-fields-font-awesome/
- **Affected versions:** from 4.0.0 before 6.2.1
- **Fixed in:** 6.2.1 (Update to 6.2.1 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/advanced-custom-fields-font-awesome
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2809/

## Description

The Advanced Custom Fields: Font Awesome Field plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Font Awesome icon field value in all versions up to, and including, 6.2.0, due to insufficient input sanitization and output escaping of the user-supplied icon JSON (such as the unicode, id, style, family, path and SVG html properties, as well as legacy class strings) when it is saved and formatted, particularly through the 'Icon Object' and 'Unicode' return formats. This makes it possible for authenticated attackers who can save a Font Awesome icon field, with Subscriber-level access and above where such a field is shown on the user profile form, or Contributor-level access and above where it is attached to posts, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the icon.

## References

- https://wpsec.com/vuln/WPSEC-2026-2809/
- https://plugins.svn.wordpress.org/advanced-custom-fields-font-awesome/tags/6.2.1/
- https://wordpress.org/plugins/advanced-custom-fields-font-awesome/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2809/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.