CVE-2026-124755 in Advanced Custom Fields Font Awesome Field Plugin
Summary
by MITRE • 11/15/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advanced Custom Fields: Font Awesome Field advanced-custom-fields-font-awesome allows Stored XSS.This issue affects Advanced Custom Fields: Font Awesome Field: from n/a through 6.1.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/15/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability is classified under the CWE-79 standard and manifests within the Advanced Custom Fields: Font Awesome Field plugin for WordPress, affecting versions from n/a through 6.1.4. The core technical issue stems from insufficient validation and sanitization of user-supplied input before it is rendered in a web browser context. When an attacker injects malicious script payloads into fields managed by this plugin, the application fails to properly escape or neutralize these inputs, allowing them to execute directly within the victim's browser session. This behavior aligns with the ATT&CK technique T1059.007, which covers JavaScript execution as a method for client-side code injection.
The specific nature of this vulnerability is stored cross-site scripting, meaning that the malicious payload is permanently saved on the target server within the plugin's database or configuration settings rather than being passed via URL parameters in a reflected attack vector. This persistence significantly amplifies the risk profile because every user who views the affected page containing the compromised field will trigger the execution of the injected script without any additional interaction required from them beyond loading the page. The vulnerability likely arises during the rendering phase where the plugin outputs font icon data or related metadata, failing to apply appropriate output encoding such as HTML entity encoding for special characters like angle brackets and quotes that are essential for breaking out of the intended context and injecting executable JavaScript code.
From an operational impact perspective, a successful exploitation allows attackers to perform actions on behalf of authenticated users with varying privilege levels depending on their role within the WordPress environment. For administrators or editors, this could lead to complete site compromise through session hijacking, cookie theft, or redirection to malicious sites designed for credential harvesting. The attacker can also manipulate page content, deface websites, or deploy further malware via drive-by downloads if combined with other vulnerabilities in browser plugins or extensions. Since the payload is stored server-side, the impact is not limited to a single victim but extends to all users who access the affected pages over time until the malicious data is manually removed from the database by an administrator.
Mitigation strategies must prioritize immediate remediation through software updates and rigorous input handling practices. The most effective defense is upgrading the Advanced Custom Fields: Font Awesome Field plugin to version 6.1.5 or later, where developers have presumably implemented proper sanitization of all user inputs before storage and strict output encoding when rendering data in HTML contexts. In environments where immediate patching is not feasible due to compatibility constraints, administrators should consider disabling the affected plugin temporarily while monitoring for suspicious activity. Additionally, implementing a Web Application Firewall with rulesets tuned to detect common XSS patterns can provide an additional layer of defense by blocking malicious requests before they reach the application logic. Regular security audits and code reviews focusing on input validation and output encoding are essential preventive measures against this class of vulnerabilities in future development cycles.