CVE-2026-96743: Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress with at least Subscriber-level access. They must also be able to submit a Table Field value that is later displayed on a page.
Who is affected by a successful exploit?
Scripts injected into a Table Field value execute when a user accesses the affected page. The vulnerability has scope changed, so impact can extend beyond the attacker’s own privileges.
Which versions require remediation?
All versions through 1.4.1-RC2, including that release candidate, are affected. The provided information does not identify a fixed version.
What is the impact of the injected script?
The issue can expose or modify information available in the victim’s browser session. The supplied vector indicates low confidentiality and integrity impact, with no availability impact.