CVE-2026-110813

The Advanced Custom Fields (ACF®) WordPress plugin, in versions prior to 6.8.11 , is vulnerable to an unauthenticated stored XSS . The root cause is insufficient sanitization of a stored field definition that can be modified via comment handling . An attacker can inject a payload that is rendered...