The vulnerability arises from improper neutralization of user input during page generation, allowing stored XSS in ACF Extended. Malicious script can be stored in a plugin field and is rendered without sanitization when a page is viewed, causing the script to execute in the browsers of any visitor.

WordPress sites that use the ACF Extended plugin up to and including version 0.9.2.7 are affected. Versions prior to the plugin’s introduction through 0.9.2.7 do not contain the fix. The flaw is present on any site running a vulnerable version of the plugin, regardless of the WordPress core version.

The CVSS score of 7.1 indicates high severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no large-scale exploitation yet. The likely attack vector is through a plugin field that accepts user input and subsequently renders it in a page; an attacker who can inject malicious code into that field will cause that code to run in the browsers of anyone who views the page. The vulnerability is limited to the scope of the affected plugin and does not require additional privileges beyond the ability to input data into the plugin fields.