CVE-2026-124755 · Other
NO FIX YET · SEE WHAT TO DO
The Advanced Custom Fields: Font Awesome Field plugin for WordPress does not neutralize input before generating web pages, allowing stored cross-site scripting. An attacker who can store input in the field can run script in the browser of anyone who views the affected page.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Advanced Custom Fields: Font Awesome Field WordPress plugin at version 6.1.4 or earlier. The sources do not say whether the plugin must be on a specific configuration or whether low-privilege accounts can store the malicious input.
Not affected if plugin-not-installed
Who cares advanced-custom-fields, font-awesome-field, wordpress
advanced-custom-fields-font-awesome plugin is installed and its version in the WordPress plugins screen or wp plugin list6.1.4 are affectedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advanced Custom Fields: Font Awesome Field advanced-custom-fields-font-awesome allows Stored XSS.This issue affects Advanced Custom Fields: Font Awesome Field: from n/a through 6.1.4.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.