Advanced Views CVE-2026-109995

Exploitation requires the target WordPress site to run Advanced Views (acf-views) version ≤3.9.6 AND to publish a page containing an avf-layout block whose Comment Content field is bound to a comment ID the attacker can control via submitted comments. The attacker injects the payload through the public 'comment' parameter; crucially, the comment does NOT need to be approved or moderated because the get_comment() lookup applies no approval-status filter, so standard comment moderation does not limit exploitation. The payload executes whenever any visitor loads the page rendering that comment-bound block. The practical limiting factor is configuration-specific: sites that do not use the plugin's comment-content field inside a rendered view/layout are not exposed, even if the vulnerable plugin is installed. No authentication is required (PR:N).

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 High) indicates remote, low-complexity, unauthenticated exploitation with a scope change - consistent with stored XSS where attacker-injected script executes in the browser security context of other site visitors. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a serious-but-not-crisis posture. No EPSS score, no CISA KEV listing, and no confirmed proof-of-concept exploit code are present in the input, so there is no evidence of active exploitation or mass weaponization; the signals point to a patch-promptly rather than drop-everything situation. The one notable amplifier specific to this flaw is that the plugin's get_comment() lookup applies no approval-status filter, so a payload fires even from pending/unapproved comments - meaning the normal moderation safeguard does NOT mitigate it, which raises real-world exploitability above a typical comment-based XSS that would require approval. The impact is bounded: C:L/I:L/A:N reflects limited confidentiality/integrity harm (session/DOM-level script execution) rather than server compromise. Net: a real priority to patch this week for sites running the plugin, but not a high-CVSS-but-illusory issue, and not an emergency on current signals.

An attacker submits a blog comment containing a crafted script payload in the 'comment' parameter on a site running Advanced Views ≤3.9.6; because the plugin's comment-content lookup ignores approval status, the comment does not need to be moderated or approved. When any visitor - including an administrator - loads a page containing an avf-layout block bound to that comment ID, the stored script executes in their browser. No public exploit code is identified in the provided sources, though the vulnerable and fixed source lines are publicly referenced.