ACF Table Field CVE-2026-96743

Exploitation requires an authenticated account with subscriber-level privileges or higher on the target site, and the attacker must be able to submit a Table Field value through the Table Field Add-on for ACF and SCF (all versions up to and including 1.4.1-RC2). The stored payload only fires when another user renders a page displaying the injected table field, so impact depends on a victim viewing the affected content. Limiting factors: the PR:L authentication requirement means anonymous attackers cannot exploit it unless the site allows self-registration of low-privilege users; sites that restrict account creation or do not expose the vulnerable table field to other users substantially reduce realistic risk.

This is a moderate-severity stored XSS (CWE-79) in a niche WordPress add-on, and the available signals point to a low real-world priority rather than an urgent one. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) indicates network-reachable, low-complexity exploitation that nonetheless requires authentication (PR:L - subscriber-level or above per the description), with a scope change (S:C) reflecting script execution in a victim's browser context and limited confidentiality/integrity impact. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied in the input; per precision rules this is treated as no public exploit identified at time of analysis, and absence of these signals is not itself evidence of safety but does argue against widespread automated exploitation. The main gating factor is the PR:L requirement: an attacker needs a valid low-privilege account, which on many sites is not available to anonymous users unless open registration is enabled. There is no conflict between the CVSS vector and the description - both agree on authenticated, network-based stored XSS - so the metrics are internally consistent; the primary uncertainty is deployment footprint and whether a given site permits subscriber self-registration.

On a WordPress site running the vulnerable plugin where low-privilege accounts exist (e.g., open subscriber registration), an authenticated attacker submits a Table Field value containing a malicious script payload, which is stored without sufficient sanitization. When an administrator, editor, or visitor later views a page rendering that table field, the script executes in their browser, enabling session/cookie theft or actions in the victim's authenticated context. No public exploit code was identified in the provided data.