ACF Table Field CVE-2026-78068

Exploitation requires an authenticated account with Contributor-level privileges or higher on the WordPress site, plus the presence of the Table Field Add-on for ACF and SCF plugin (version ≤ 1.3.35) with a table field in use where the attacker can edit cell content. The specific vector is the 'Table Cell Content' input, which is insufficiently sanitized on input and insufficiently escaped on output. Limiting factors: the attacker must already have a trusted editorial role (not anonymous/unauthenticated), so risk is concentrated on multi-author sites, membership sites, or sites allowing open Contributor registration; sites restricting content creation to trusted staff face substantially reduced exposure. The injected script executes only when a user subsequently accesses the page containing the malicious table cell.

This is a moderate, not top-priority, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, score 6.4 Medium) shows network-reachable, low-complexity exploitation but requires authenticated access at Contributor level (PR:L), which materially limits the attacker population to users who already have a trusted editorial role on the site. The scope change (S:C) correctly reflects that injected scripts execute in the browsers of other users/administrators, which is the real danger of stored XSS. No EPSS score was provided in the input, no CISA KEV listing is present, and no public proof-of-concept is referenced, so all three exploitation-likelihood signals are either absent or negative - this is a disclosed-but-not-known-exploited vulnerability. The signals are internally consistent (authenticated low-privilege stored XSS), with no contradiction between the vector and the description, both of which agree on Contributor-level authenticated access and script injection via table cell content. The practical priority should be driven by whether the affected site grants Contributor accounts to semi-trusted or untrusted users; on sites that do, privilege escalation to administrator via stored XSS is a realistic concern, whereas single-author or tightly-controlled sites face minimal exposure.

An attacker who holds (or phishes/registers for) a Contributor-level account on a WordPress site running this plugin inserts a malicious JavaScript payload into a table cell of an ACF/SCF table field within a draft or submitted post. When an editor or administrator reviews or an ordinary visitor loads the resulting page, the script executes in their browser session, enabling session/cookie theft or actions performed as the higher-privileged user. No public exploit code is identified at time of analysis, and exploitation requires authenticated Contributor access (PR:L) but no victim interaction beyond normally viewing the page (UI:N).