CVE-2026-110813 Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection

The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the...

CVE-2026-110813

The Advanced Custom Fields (ACF®) WordPress plugin, in versions prior to 6.8.11 , is vulnerable to an unauthenticated stored XSS . The root cause is insufficient sanitization of a stored field definition that can be modified via comment handling . An attacker can inject a payload that is rendered...