A weakness exists in the Advanced Custom Fields: Font Awesome plugin that allows a user with Subscriber-level access or higher to store arbitrary JavaScript in a JSON field. Once stored, the plugin’s JavaScript builds unsafe HTML for previewing the field, causing the shell injected code to run whenever a page containing that field is viewed. The impact is the loss of confidentiality, integrity, and availability of the hosted website, as the attacker can execute scripts under the victim’s browser context, potentially collecting credentials or modifying page content.

WordPress sites running the Advanced Custom Fields: Font Awesome plugin version 5.0.2 or earlier, provided by the vendor justinkruit. The vulnerability is only exploitable when the attacker can authenticate at least as a Subscriber or higher role.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, so the known public exploitation probability is uncertain. The attack vector is inferred to be authenticated through normal media‑editing functions that allow manipulation of the affected JSON field. An attacker would need legitimate account access to the WordPress installation to exploit this flaw.