{"id":"CVE-2026-110813","kind":"vulnerability","aliases":["CVE-2026-110813"],"related":[],"title":"Advanced Custom Fields WordPress plugin: stored field lets visitors run JavaScript","description":"The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.","summary":"The Advanced Custom Fields (ACF) WordPress plugin does not sanitize a stored field definition that unauthenticated users can modify through comment handling. An attacker can inject a payload that runs as JavaScript in the browser of any visitor or administrator who views a page rendering that field.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["advanced-custom-fields","package","self-hosted","wordpress"],"not_affected_if":["acf-not-installed","acf-version-6.8.11-or-later"],"how_to_check":"- Check the installed ACF plugin version in the WordPress Plugins screen; versions before `6.8.11` are affected.\n- Look for ACF fields that render on public pages and on admin screens.","fix":"- Advanced Custom Fields (WordPress plugin): upgrade to `6.8.11` or later.","status":"open","published_at":"2026-11-06T06:16:39+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","triaged_at":"2026-11-06T06:42:08+00:00","updated_at":"2026-11-06T06:42:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T06:42:08Z","model":"claude-haiku-5-5","output":{"fix":"- Advanced Custom Fields (WordPress plugin): upgrade to `6.8.11` or later.","reach":"internet","title":"Advanced Custom Fields WordPress plugin: stored field lets visitors run JavaScript","impact":"high","summary":"The Advanced Custom Fields (ACF) WordPress plugin does not sanitize a stored field definition that unauthenticated users can modify through comment handling. An attacker can inject a payload that runs as JavaScript in the browser of any visitor or administrator who views a page rendering that field.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","advanced-custom-fields","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs JavaScript in visitors' and administrators' browsers","analyst_note":"Confirm the CVSS score and whether the sources give severity; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-110813 for the exact affected field types.","how_to_check":"- Check the installed ACF plugin version in the WordPress Plugins screen; versions before `6.8.11` are affected.\n- Look for ACF fields that render on public pages and on admin screens.","plain_action":"","needs_analyst":true,"not_affected_if":["acf-version-6.8.11-or-later","acf-not-installed"],"who_is_affected":"Sites running the Advanced Custom Fields WordPress plugin before 6.8.11 are exposed when a page renders an affected field. Unauthenticated users can inject the payload through comment handling, so the attack needs no login. Sites without ACF, or on 6.8.11 or later, are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001171,"input_tokens":4247,"output_tokens":1492,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110813':14A,17A '-2026':13A,16A '6.8.11':82C 'acf':31B,78C 'administr':66B,125C 'advanc':1A,19B,28B,75C 'advanced-custom-field':18B 'affect':132C 'allow':99C 'attack':50B 'attribut':112C 'browser':61B,120C 'comment':47B,97C 'custom':2A,20B,29B,76C 'cve':12A,15A 'definit':40B,90C 'emit':108C 'execut':115C 'field':3A,7A,21B,30B,39B,73B,77C,89C,133C 'handl':48B,98C 'host':25B 'html':111C 'inject':52B,103C 'javascript':11A,58B,117C 'let':8A 'modifi':45B,94C 'name':113C 'packag':22B 'page':70B,129C 'payload':54B,105C 'plugin':5A,33B,80C 'proper':85C 'render':71B,130C 'run':10A,56B 'sanit':36B,86C 'self':24B 'self-host':23B 'store':6A,38B,88C 'unauthent':42B,100C 'user':43B,101C 'view':68B,127C 'visitor':9A,64B,123C 'wordpress':4A,26B,32B,79C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advanced Custom Fields WordPress plugin before 6.8.11 are exposed when a page renders an affected field. Unauthenticated users can inject the payload through comment handling, so the attack needs no login. Sites without ACF, or on 6.8.11 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["advancedcustomfields","high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-110813':14A,17A '-2026':13A,16A 'advanc':1A 'custom':2A 'cve':12A,15A 'field':3A,7A 'javascript':11A 'let':8A 'plugin':5A 'run':10A 'store':6A 'visitor':9A 'wordpress':4A","search_b":"'acf':31B 'administr':66B 'advanc':19B,28B 'advanced-custom-field':18B 'attack':50B 'browser':61B 'comment':47B 'custom':20B,29B 'definit':40B 'field':21B,30B,39B,73B 'handl':48B 'host':25B 'inject':52B 'javascript':58B 'modifi':45B 'packag':22B 'page':70B 'payload':54B 'plugin':33B 'render':71B 'run':56B 'sanit':36B 'self':24B 'self-host':23B 'store':38B 'unauthent':42B 'user':43B 'view':68B 'visitor':64B 'wordpress':26B,32B","search_c":"'6.8.11':82C 'acf':78C 'administr':125C 'advanc':75C 'affect':132C 'allow':99C 'attribut':112C 'browser':120C 'comment':97C 'custom':76C 'definit':90C 'emit':108C 'execut':115C 'field':77C,89C,133C 'handl':98C 'html':111C 'inject':103C 'javascript':117C 'modifi':94C 'name':113C 'page':129C 'payload':105C 'plugin':80C 'proper':85C 'render':130C 'sanit':86C 'store':88C 'unauthent':100C 'user':101C 'view':127C 'visitor':123C 'wordpress':79C","first_public_at":"2026-11-06T06:16:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110813","severity":null,"published_at":"2026-11-06T06:16:39+00:00","modified_at":"2026-11-06T06:16:39+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","fetched_at":"2026-11-06T06:40:11+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}