Technical impact
An improper neutralization of user input in the Advanced Custom Fields: Font Awesome Field plugin allows stored cross‑site scripting. When content containing malicious scripts is submitted via the plugin’s custom field, the data is saved to the database and later rendered without sanitization, enabling the execution of arbitrary JavaScript in the browsers of anyone who views the affected page. The vulnerability can be leveraged to hijack user sessions, deface sites, or deploy phishing payloads. The flaw is a classic input validation weakness listed as CWE‑79.
Affected Systems
The flaw affects the WordPress plugin Justin Kruit: Advanced Custom Fields: Font Awesome Field version 6.1.4 and all lower releases. Any WordPress installation that has this plugin activated and is allowed to input data through the Font Awesome field is potentially compromised.
Risk and Exploitability
The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, but the vulnerability is not present in the CISA KEV catalog, suggesting no publicly known exploits yet. The likely attack vector is through the plugin’s field input mechanism, requiring the attacker to submit content that the site subsequently renders; thus, control over a user account with content‑creation privileges is a prerequisite. If an implicit or explicit write path to the database is available, the vulnerability could be exploited by an attacker with write permissions, but remote unauthenticated exploitation is not indicated by the description.
