---
id: CVE-2026-110813
title: >-
  Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML
  Attribute Name Injection
summary: >-
  The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not
  properly sanitize a stored field definition that can be modified through its
  comment handling, allowing unauthenticated users to inject a payload that is
  emitted a…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-79
product: Advanced Custom Fields (ACF®)
affected:
  - advanced_custom_fields_acf < 6.8.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T11:49:07.541490Z'
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:01:52.162Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110813'
references:
  - url: 'https://wpscan.com/vulnerability/f7373dad-036e-47f4-b8a5-584341f66560/'
tags:
  - cve.org
ingestedAt: '2026-11-06T06:46:27.274Z'
epss: 0.00267
epssPercentile: 0.18929
---

## Overview

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.

## Affected

- `advanced_custom_fields_acf < 6.8.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.