PT-2026-137809

CVE-2026-110813

Published

2026-11-04

Updated

2026-11-06

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields (ACF®) versions prior to 6.8.11

Description Insufficient input sanitization and output escaping in the comment handling of stored field definitions allow unauthenticated users to perform Stored Cross-Site Scripting (XSS). An attacker can inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.

Recommendations Update to version 6.8.11 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jakub Herman

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers