What is the CVSS score of CVE-2026-6415?

CVE-2026-6415 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Advanced Custom Fields: Font Awesome CVE-2026-6415

EUVD-2026-30521 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-15 Wordfence

GHSA-59fm-cmjw-gc79

XSS WordPress Advanced Custom Fields

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 09:31 vuln.today

CVE Published

May 15, 2026 - 07:46 nvd

MEDIUM 6.4

DescriptionCVE.org

The Advanced Custom Fields: Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.0.2. This is due to insufficient input validation of JSON field values and unsafe client-side HTML construction in the update_preview() JavaScript function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Advanced Custom Fields: Font Awesome plugin for WordPress up to version 5.0.2 allows authenticated attackers with Subscriber-level access to inject arbitrary JavaScript via insufficiently validated JSON field values in the update_preview() function, resulting in script execution whenever any user visits an affected page. The vulnerability requires user interaction only in the sense that a victim must visit a page containing injected content; the attacker needs only Subscriber-level authentication to craft the malicious payload.

Technical ContextAI

The Advanced Custom Fields: Font Awesome plugin is a WordPress extension that provides a custom field type for Font Awesome icon selection. The vulnerability stems from unsafe client-side HTML construction in the update_preview() JavaScript function (located in assets/js/input-v6.js), which processes JSON field values without proper sanitization. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), wherein user-controlled JSON data is directly inserted into the DOM without encoding or validation, allowing script payload injection. The plugin's reliance on client-side validation and direct HTML manipulation creates a persistent XSS vector accessible to any authenticated WordPress user at Subscriber level or higher.

RemediationAI

Update Advanced Custom Fields: Font Awesome plugin to the patched version released after 5.0.2 immediately via WordPress admin dashboard or plugin repository. Patch availability is confirmed via WordPress plugin repository changeset 3525840. As an interim workaround on sites unable to update immediately, disable the Font Awesome field type in Advanced Custom Fields configuration if it is not actively in use. Restrict user roles to remove Subscriber-level permissions for creating or editing posts/pages containing ACF Font Awesome fields, limiting attack surface to Editor and Administrator roles only. Implement Content Security Policy (CSP) headers with script-src restrictions to mitigate the impact of injected JavaScript, though this does not prevent injection itself. Regularly audit user accounts and ACF field values for suspicious JSON payloads or script tags. Monitor WordPress access logs for unusual ACF field update activity from low-privilege accounts.