CVE-2026-115452 · Runtime
NO FIX YET · SEE WHAT TO DO
A user allowed to edit a Map marker label in the Advanced Custom Fields extension for Joomla can store a script in it. The script then runs in the browser of anyone who opens that marker.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Joomla sites running the affected Advanced Custom Fields or Smile Pack versions that use Map fields with marker labels. The attacker must be a user who can edit those labels, such as an article author, and the script runs for visitors who open the marker. Sites without the extension or without Map fields can skip it.
Not affected if extension-not-installed, fixed-version, no-map-fields
Who cares advanced-custom-fields, joomla, self-hosted, smile-pack
2.8.2-2.8.15 and 3.0.0-3.1.8; the sources do not name the fixed version.1.1.2-1.2.9 and 2.0.0-2.1.6; the sources do not name the fixed version.Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.