Advanced Custom Fields, on 2 million sites, patches an unauthenticated XSS bug
CVE-2026-110813 lets an unauthenticated visitor store a payload through comment handling that runs as JavaScript for anyone, including admins, who views the page. Fixed in ACF 6.8.11.
Advanced Custom Fields, the WordPress plugin with over 2 million active installs, shipped version 6.8.11 on 2 November fixing a stored cross-site scripting flaw later tracked as CVE-2026-110813. The bug sits in how ACF sanitises a stored field definition reachable through its comment handling: an unauthenticated visitor can inject a payload that gets emitted as an HTML attribute name, so it runs as JavaScript for anyone, including an admin, who later views a page rendering that field. It’s rated CVSS 7.5.
ACF’s own changelog doesn’t name the CVE, but it lists the matching fix: field and group settings saved by users without the unfiltered_html capability are now sanitised, stripping event-handler attributes and limiting wrapper settings to width, class and id. The CVE record itself, published 6 November, isn’t flagged as under active exploitation.
Why it matters: ACF underpins custom fields on a large share of professional WordPress sites, and this one needs no account at all to trigger. If you’re running ACF and haven’t updated past 6.8.10, do it now rather than waiting for a routine plugin sweep.
The caveat: the plugin’s own release notes describe the fix in general terms rather than confirming the CVE by number, so some detail here comes from the CVE record and WPScan’s vulnerability database rather than the vendor directly.