Stored XSS in Sympl Repeater for ACF and Elementor WordPress Plugin

Executive Summary

The Sympl Repeater for ACF and Elementor plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 2.3. This occurs because the plugin does not properly sanitize or escape input in the symp_arfe_replace_content() function. Specifically, it uses str_replace() to insert raw ACF repeater field values directly into Elementor-rendered HTML without escaping, allowing authenticated users with Author-level access or higher to inject malicious scripts that execute when other users view the affected pages.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with Author-level access or above to inject arbitrary malicious scripts into web pages. These scripts will execute in the browsers of users who visit the injected pages, potentially leading to theft of user credentials, session hijacking, defacement, or other malicious actions. Because the vulnerability is a Stored Cross-Site Scripting issue, the malicious code persists on the site and affects all users who access the compromised content.

Useful 0 Not Useful 0