{"id":"CVE-2026-124755","kind":"vulnerability","aliases":["CVE-2026-124755"],"related":[],"title":"Advanced Custom Fields Font Awesome Field plugin: stored XSS through 6.1.4","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advanced Custom Fields: Font Awesome Field advanced-custom-fields-font-awesome allows Stored XSS.This issue affects Advanced Custom Fields: Font Awesome Field: from n/a through 6.1.4.","summary":"The Advanced Custom Fields: Font Awesome Field plugin for WordPress does not neutralize input before generating web pages, allowing stored cross-site scripting. An attacker who can store input in the field can run script in the browser of anyone who views the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["advanced-custom-fields","font-awesome-field","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `advanced-custom-fields-font-awesome` plugin is installed and its version in the WordPress plugins screen or `wp plugin list`","fix":"- Advanced Custom Fields: Font Awesome Field: no fixed version stated in the sources; versions through `6.1.4` are affected","status":"open","published_at":"2026-11-15T14:17:24+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","triaged_at":"2026-11-15T14:37:44+00:00","updated_at":"2026-11-15T14:37:44+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-15T14:37:44Z","model":"claude-haiku-5-5","output":{"fix":"- Advanced Custom Fields: Font Awesome Field: no fixed version stated in the sources; versions through `6.1.4` are affected","reach":"internet","title":"Advanced Custom Fields Font Awesome Field plugin: stored XSS through 6.1.4","impact":"medium","summary":"The Advanced Custom Fields: Font Awesome Field plugin for WordPress does not neutralize input before generating web pages, allowing stored cross-site scripting. An attacker who can store input in the field can run script in the browser of anyone who views the affected page.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","advanced-custom-fields","font-awesome-field"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers, stealing sessions or data.","analyst_note":"Confirm the fixed version and required privileges from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124755 or the WordPress plugin changelog.","how_to_check":"- Check whether the `advanced-custom-fields-font-awesome` plugin is installed and its version in the WordPress plugins screen or `wp plugin list`\n- unknown for other checks","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Advanced Custom Fields: Font Awesome Field WordPress plugin at version 6.1.4 or earlier. The sources do not say whether the plugin must be on a specific configuration or whether low-privilege accounts can store the malicious input.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000776,"input_tokens":4585,"output_tokens":634,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124755':14A,17A '-2026':13A,16A '6.1.4':11A,116C 'advanc':1A,19B,29B,90C,97C,107C 'advanced-custom-field':18B 'advanced-custom-fields-font-awesom':96C 'affect':72B,106C 'allow':46B,102C 'anyon':68B 'attack':53B 'awesom':5A,24B,33B,94C,101C,111C 'browser':66B 'cross':49B,83C 'cross-sit':48B,82C 'custom':2A,20B,30B,91C,98C,108C 'cve':12A,15A 'field':3A,6A,21B,25B,31B,34B,60B,92C,95C,99C,109C,112C 'font':4A,23B,32B,93C,100C,110C 'font-awesome-field':22B 'generat':43B,81C 'improp':74C 'input':41B,57B,77C 'issu':105C 'justin':88C 'kruit':89C 'n/a':114C 'neutral':40B,75C 'page':45B,73B,80C 'plugin':7A,35B 'run':62B 'script':51B,63B,85C 'site':50B,84C 'store':8A,47B,56B,103C 'view':70B 'vulner':86C 'web':44B,79C 'wordpress':27B,37B 'xss':9A 'xss.this':104C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advanced Custom Fields: Font Awesome Field WordPress plugin at version 6.1.4 or earlier. The sources do not say whether the plugin must be on a specific configuration or whether low-privilege accounts can store the malicious input.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["advancedcustomfields","fontawesomefield","medium","other","wordpress"],"campaign_type":null,"search_a":"'-124755':14A,17A '-2026':13A,16A '6.1.4':11A 'advanc':1A 'awesom':5A 'custom':2A 'cve':12A,15A 'field':3A,6A 'font':4A 'plugin':7A 'store':8A 'xss':9A","search_b":"'advanc':19B,29B 'advanced-custom-field':18B 'affect':72B 'allow':46B 'anyon':68B 'attack':53B 'awesom':24B,33B 'browser':66B 'cross':49B 'cross-sit':48B 'custom':20B,30B 'field':21B,25B,31B,34B,60B 'font':23B,32B 'font-awesome-field':22B 'generat':43B 'input':41B,57B 'neutral':40B 'page':45B,73B 'plugin':35B 'run':62B 'script':51B,63B 'site':50B 'store':47B,56B 'view':70B 'web':44B 'wordpress':27B,37B","search_c":"'6.1.4':116C 'advanc':90C,97C,107C 'advanced-custom-fields-font-awesom':96C 'affect':106C 'allow':102C 'awesom':94C,101C,111C 'cross':83C 'cross-sit':82C 'custom':91C,98C,108C 'field':92C,95C,99C,109C,112C 'font':93C,100C,110C 'generat':81C 'improp':74C 'input':77C 'issu':105C 'justin':88C 'kruit':89C 'n/a':114C 'neutral':75C 'page':80C 'script':85C 'site':84C 'store':103C 'vulner':86C 'web':79C 'xss.this':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124755","severity":null,"published_at":"2026-11-15T14:17:24+00:00","modified_at":"2026-11-15T14:17:24+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","fetched_at":"2026-11-15T14:36:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}