CVE-2026-97195

The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user able to configure its fields to store a payload that executes as JavaScript in the browser of any user who views a page...

CVE-2026-110813 Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection

The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the...

CVE-2026-110813

The Advanced Custom Fields (ACF®) WordPress plugin before version 6.8.11 is vulnerable to an unauthenticated stored XSS vulnerability. The root cause is the improper sanitization of a stored field definition, which can be modified through its comment handling. An attacker can inject a payload tha...