CVE-2026-124755
Deferred Deferred - Pending Action

Stored XSS in Advanced Custom Fields Font Awesome Field

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: Patchstack

Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advanced Custom Fields: Font Awesome Field advanced-custom-fields-font-awesome allows Stored XSS.This issue affects Advanced Custom Fields: Font Awesome Field: from n/a through 6.1.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-124755
EUVD
EUVD-2026-126058

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
justin_kruit advanced_custom_fields_font_awesome_field to 6.1.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Advanced Custom Fields: Font Awesome Field plugin. It allows attackers to inject malicious scripts into web pages that are stored on the server and executed when other users view those pages.

Detection Guidance

To detect this Stored XSS vulnerability in Advanced Custom Fields: Font Awesome Field, inspect WordPress sites using the vulnerable plugin versions. Check for unauthorized JavaScript in stored field values or database entries. Review plugin files for suspicious input handling in versions before 6.1.4.

Impact Analysis

An attacker could steal user sessions, deface websites, or perform actions on behalf of users. Users with access to the plugin could exploit this to gain unauthorized control over the site.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR (data protection) and HIPAA (health data privacy) by exposing sensitive user information or allowing unauthorized access to systems.

Mitigation Strategies

Immediately update Advanced Custom Fields: Font Awesome Field to version 6.1.4 or later. Remove any untrusted JavaScript from stored field values. Implement input validation for user-supplied data in WordPress forms.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124755. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...