CVE-2026-110813 · Package
NO FIX YET · SEE WHAT TO DO
The Advanced Custom Fields (ACF) WordPress plugin does not sanitize a stored field definition that unauthenticated users can modify through comment handling. An attacker can inject a payload that runs as JavaScript in the browser of any visitor or administrator who views a page rendering that field.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Advanced Custom Fields WordPress plugin before 6.8.11 are exposed when a page renders an affected field. Unauthenticated users can inject the payload through comment handling, so the attack needs no login. Sites without ACF, or on 6.8.11 or later, are not affected.
Not affected if acf-not-installed, acf-version-6.8.11-or-later
Who cares advanced-custom-fields, self-hosted, wordpress
6.8.11 are affected.6.8.11 or later.The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.