CVE-2026-49044

MediumCVSS 6.5

Published: 27/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

The Advanced Custom Fields: Font Awesome Field plugin (through 5.0.2) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be stored and executed in a user's browser.

Risk Assessment

An attacker can store a malicious script that executes in the session of an administrator or other users, enabling session theft or actions on behalf of the victim. This affects the confidentiality and integrity of the WordPress site.

Recommendation

Update the Advanced Custom Fields: Font Awesome Field plugin to a version later than 5.0.2. Additionally, consider deploying Content-Security-Policy headers and input sanitization.

Other vulnerabilities in Advanced Custom Fields: Font Awesome Field

CVE-2026-66678Medium
Broken Access Control vulnerability in Advanced Custom Fields: Font Awesome Field versions up to 6.1.1 allows a user with Contributor role to access unauthorized functions.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advanced Custom Fields: Font Awesome Field allows Stored XSS. This issue affects Advanced Custom Fields: Font Awesome Field: from n/a through 5.0.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS