What is the CVSS score of EUVD-2026-42176?

EUVD-2026-42176 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Sympl Repeater ACF EUVD-2026-42176

| CVE-2026-10570 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-08 Wordfence

GHSA-xr3q-2xmr-89w4

WordPress XSS Wordpress Plugin Sympl Repeater For Acf And Elementor

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Author-level credentials required (PR:L); victim must passively visit the injected page to trigger execution (UI:R); scope change captures cross-browser impact (S:C); no availability impact warranted.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 06:37 vuln.today

CVE Published

Jul 08, 2026 - 05:34 nvd

MEDIUM 6.4

DescriptionCVE.org

The Sympl Repeater for ACF and Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ACF repeater field values in all versions up to, and including, 2.3. This is due to insufficient input sanitization and output escaping in the symp_arfe_replace_content() function, which uses str_replace() to substitute raw ACF field values (retrieved via get_field()) directly into Elementor-rendered HTML without any escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the Sympl Repeater for ACF and Elementor WordPress plugin (all versions up to and including 2.3) allows authenticated attackers with Author-level access to inject persistent malicious scripts into pages via unsanitized ACF repeater field values. The root cause is the symp_arfe_replace_content() function using PHP str_replace() to insert raw get_field() output directly into Elementor-rendered HTML without any output encoding, causing the stored payload to execute in any subsequent visitor's browser. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changed CVSS vector (6.4 Medium) reflects real cross-user impact on WordPress sites where multiple Authors are active.

Technical ContextAI

The affected plugin bridges two popular WordPress ecosystems: Advanced Custom Fields (ACF), which provides structured repeater field data, and Elementor, a widely-used page builder. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). The specific root cause is in symp_arfe_replace_content() at line 179 of sympl-repeater-for-acf-and-elementor.php (source visible at the plugins.trac.wordpress.org tag/2.3 tree), where PHP str_replace() uses the raw return value of get_field() - the ACF field retrieval API - as the substitution string injected into Elementor's rendered HTML, without applying esc_html(), esc_attr(), wp_kses(), or any equivalent WordPress output-encoding function. A secondary reference at line 99 of the same file likely reflects the content-processing pipeline feeding into this function. The CPE for the affected component is cpe:2.3:a:idocoh:sympl_repeater_for_acf_and_elementor:*:*:*:*:*:*:*:*, published by vendor idocoh.

RemediationAI

No patched version is confirmed in the available data - the CPE wildcard covers all versions through 2.3 with no upper-bound fix release identified, and the Wordfence advisory does not reference a patched version. Administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/daa38c2c-9992-400b-acef-dcd37f9c7269 for a patch release and apply it immediately when available. As an immediate compensating control, deactivating or uninstalling the Sympl Repeater for ACF and Elementor plugin eliminates the attack surface entirely, at the cost of disabling ACF repeater field rendering within Elementor templates that depend on it. If deactivation is operationally infeasible, restrict Author-level and higher WordPress roles exclusively to fully trusted individuals, and audit existing ACF repeater field values across all posts and pages for evidence of injected script content. Do not grant Author access to untrusted contributors while this vulnerability remains unpatched.