Junglewise Threat Intelligence

CVE-2026-10570: Sympl Repeater for ACF and Elementor Stored XSS in symp_arfe_replace_content

CVE-2026-10570 · Severity: medium · CVSS 6.4 · Published 2026-07-08

Executive brief

The Sympl Repeater for ACF and Elementor plugin is a WordPress tool used to display complex data layouts on websites. A security flaw allows users with 'Author' level permissions or higher to inject malicious scripts into website pages. These scripts will automatically run in the browser of any visitor who views the affected page, potentially leading to unauthorized actions or data theft.

Technical details

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw located in the symp_arfe_replace_content() function. The root cause is the use of str_replace() to substitute raw Advanced Custom Fields (ACF) values, retrieved via get_field(), directly into Elementor-rendered HTML without proper sanitization or output escaping. An authenticated attacker with Author-level privileges or higher can exploit this by saving malicious scripts into ACF repeater fields. These scripts are then executed in the context of any user's browser session when they visit the compromised page. The vulnerability affects all versions up to and including 2.3.

Affected products

  • idocoh Sympl Repeater for ACF and Elementor up to, and including, 2.3

Timeline

  • 2026-07-08: disclosed: Vulnerability published to the CVE list.
  • 2026-07-08: advisory: Wordfence published security advisory.

References