The Sympl Repeater for ACF and Elementor plugin for WordPress embeds raw ACF repeater field values directly into Elementor output without escaping. An attacker with at Author level access can insert arbitrary JavaScript that will run in the browsers of any user who visits a page containing the injected field. The vulnerability is a classic instance of CWE‑79, caused by insufficient input sanitization and lack of output escaping.

The affected product is the Sympl Repeater for ACF and Elementor plugin, released by idocoh. All versions up to and including 2.3 are impacted. Any WordPress site that has installed one of these versions and uses repeater fields for content is at risk. The description does not state that the core WordPress installation is affected, so we infer that the vulnerability is limited to the plugin itself.

The CVSS score of 6.4 indicates medium severity. The EPSS score is < 1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack path requires a logged‑in user with Author or higher permissions, who can enter malicious JavaScript into a repeater field via the WordPress admin. Once the payload is stored, it propagates to every visitor of the affected page, giving the attacker widespread impact. Although the exploit needs authenticated access, the resulting XSS can affect all site users.