CVE-2026-110813: Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection

Q: Which sites are exposed to this issue?

WordPress sites using Advanced Custom Fields versions before 6.8.11 are exposed if they render a field whose stored definition can be modified through the plugin's comment handling. Both ordinary visitors and administrators can be affected when they view a page that renders the manipulated field.

Q: Does exploitation require an authenticated WordPress account?

No. The issue is described as unauthenticated, so an attacker does not need to log in before injecting the payload through the affected comment-handling path.

Q: What is the immediate mitigation if upgrading is not possible?

The provided information does not specify a workaround. Prioritize preventing untrusted users from reaching the affected comment-handling functionality and avoid rendering fields whose definitions may have been modified until the plugin can be updated to 6.8.11 or later.

Published Nov 6, 2026

Updated

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which sites are exposed to this issue?

WordPress sites using Advanced Custom Fields versions before 6.8.11 are exposed if they render a field whose stored definition can be modified through the plugin's comment handling. Both ordinary visitors and administrators can be affected when they view a page that renders the manipulated field.

Does exploitation require an authenticated WordPress account?

No. The issue is described as unauthenticated, so an attacker does not need to log in before injecting the payload through the affected comment-handling path.

What is the immediate mitigation if upgrading is not possible?

The provided information does not specify a workaround. Prioritize preventing untrusted users from reaching the affected comment-handling functionality and avoid rendering fields whose definitions may have been modified until the plugin can be updated to 6.8.11 or later.

CVE-2026-110813: Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection

Event History

Frequently Asked Questions

Which sites are exposed to this issue?

Does exploitation require an authenticated WordPress account?

What is the immediate mitigation if upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to this issue?

Does exploitation require an authenticated WordPress account?

What is the immediate mitigation if upgrading is not possible?