CVE-2026-78068 in Table Field Add-on for ACF and SCF Plugin
Summary
by MITRE • 10/10/2026
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell Content in all versions up to, and including, 1.3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified within the Table Field Add-on for Advanced Custom Fields (ACF) and Simple Content Framework (SCF), specifically affecting versions up through 1.3.35, represents a significant security risk rooted in inadequate input sanitization and output escaping mechanisms. This flaw allows for Stored Cross-Site Scripting attacks targeting the table cell content functionality of the plugin. Unlike reflected XSS where malicious scripts are executed immediately within a victim's browser via a crafted link, stored vulnerabilities persist on the target server by being saved into databases or other storage mediums. In this specific context, the lack of proper validation when processing user-supplied data entered into table cells means that arbitrary JavaScript code can be embedded directly into the page content structure. This persistence ensures that the malicious payload is not a one-time event but remains active until manually removed from the database by an administrator, thereby increasing the window of exposure and potential impact significantly compared to transient injection flaws.
The operational impact of this vulnerability is severe due to its reliance on authenticated access with Contributor-level privileges or higher. While high-privilege attackers such as administrators pose a greater threat, the inclusion of contributor-level accounts expands the attack surface considerably. Contributors often have legitimate reasons to create and edit content containing tables, making them frequent targets for exploitation by lower-tier malicious actors who may have compromised these accounts through credential stuffing, phishing, or other means. Once an attacker successfully injects scripts into table cell contents, any user accessing a page containing that specific table will trigger the execution of the injected code within their browser session. This can lead to account hijacking via session token theft, defacement of website content, redirection to malicious sites designed for further malware distribution, or the harvesting of sensitive information such as personal data from users interacting with the compromised pages. The ability to execute arbitrary scripts effectively grants the attacker control over the client-side environment of every visitor viewing the affected content.
From a technical classification perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under the subcategory of Stored XSS where untrusted data is stored and later retrieved without proper validation. Furthermore, in terms of tactical mapping within the MITRE ATT&CK framework for enterprise security, this behavior corresponds to T1059 Command and Scripting Interpreter, particularly when considering how JavaScript can be used to execute further commands or exfiltrate data. It also relates to T1189 Drive-by Compromise if the script leads users to malicious destinations, and potentially T1204 User Execution if social engineering is employed alongside the stored payload to encourage interaction with specific elements on the page. Understanding these mappings helps security teams prioritize detection rules and monitoring strategies that focus on anomalous content injection patterns within database fields associated with web rendering engines.
Mitigation for this vulnerability requires immediate action by site administrators and developers responsible for maintaining WordPress installations using affected plugins. The most effective remediation is to upgrade the Table Field Add-on plugin to version 1.3.36 or any subsequent release where these sanitization issues have been addressed. Developers should ensure that all user inputs are strictly validated against expected formats before storage, utilizing allowlists rather than deny lists for character sets permitted in table cells. Additionally, output escaping must be enforced rigorously when rendering data back to the browser context, ensuring that special characters such as angle brackets and quotes are encoded appropriately to prevent them from being interpreted as executable code by the web browser. Implementing a Content Security Policy (CSP) can also serve as an effective defense-in-depth measure, restricting the sources from which scripts can be loaded and executed, thereby mitigating the impact even if some injection attempts succeed in bypassing input filters. Regular security audits and penetration testing of custom plugins are recommended to identify similar flaws before they can be exploited in production environments.