Executive brief
A vulnerability exists in the Font Awesome Field extension for WordPress, which allows users to add icons to their websites. An attacker with contributor-level access can inject malicious scripts into the site's content. When other users or administrators view the affected pages, these scripts could execute, potentially leading to unauthorized actions or data theft.
Technical details
The Advanced Custom Fields: Font Awesome Field plugin for WordPress (versions up to 5.0.2) is vulnerable to Stored Cross-Site Scripting (XSS) via the CWE-79 weakness. The vulnerability stems from improper neutralization of user-supplied input during web page generation. An attacker with 'Contributor' or higher privileges can inject malicious JavaScript into the Font Awesome field. This script is then stored on the server and executed in the browser of any user (including administrators) who visits the affected page. Exploitation requires minimal user interaction (viewing the page) and is facilitated by the plugin's failure to properly sanitize or escape input before rendering it. As of the advisory date, no official patch has been released.
Affected products
- Justin Kruit Advanced Custom Fields: Font Awesome Field up to 5.0.2
Timeline
- 2026-02-09: other: Reported by researcher timomangcut
- 2026-05-27: advisory: Published by Patchstack
- 2026-05-27: disclosed: NVD publication date