Table Field Add On For Acf And Scf
Monthly
Stored cross-site scripting in the Table Field Add-on for ACF and SCF (WordPress plugin, all versions up to and including 1.3.35) lets an authenticated attacker holding Contributor-level privileges or higher inject arbitrary JavaScript through table cell content, which then executes in the browser of any user who later views the affected page. The flaw is a classic CWE-79 defect: cell content is insufficiently sanitized on input and insufficiently escaped on output, so payloads persist in post data and are served back to victims. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) with scope change because the script runs in the security context of the site and can reach higher-privileged viewers; no public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a moderate-priority hardening item rather than an emergency.
Stored cross-site scripting in the Table Field Add-on for ACF and SCF (WordPress plugin slug advanced-custom-fields-table-field, vendor jonua) affects all versions up to and including 1.4.1-RC2, allowing an authenticated attacker with subscriber-level access or above to inject arbitrary scripts into table field values that execute when a victim views a page rendering that field. The issue carries a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting the low privilege bar and scope change typical of stored XSS inside the WordPress rendering context, though exploitation stops short of RCE and depends on a victim viewing the poisoned content. No public exploit identified at time of analysis, and no evidence of active exploitation; vendor-released patch: 1.4.1.
Stored cross-site scripting in the Table Field Add-on for ACF and SCF (WordPress plugin, all versions up to and including 1.3.35) lets an authenticated attacker holding Contributor-level privileges or higher inject arbitrary JavaScript through table cell content, which then executes in the browser of any user who later views the affected page. The flaw is a classic CWE-79 defect: cell content is insufficiently sanitized on input and insufficiently escaped on output, so payloads persist in post data and are served back to victims. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) with scope change because the script runs in the security context of the site and can reach higher-privileged viewers; no public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a moderate-priority hardening item rather than an emergency.
Stored cross-site scripting in the Table Field Add-on for ACF and SCF (WordPress plugin slug advanced-custom-fields-table-field, vendor jonua) affects all versions up to and including 1.4.1-RC2, allowing an authenticated attacker with subscriber-level access or above to inject arbitrary scripts into table field values that execute when a victim views a page rendering that field. The issue carries a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting the low privilege bar and scope change typical of stored XSS inside the WordPress rendering context, though exploitation stops short of RCE and depends on a victim viewing the poisoned content. No public exploit identified at time of analysis, and no evidence of active exploitation; vendor-released patch: 1.4.1.