Advanced Custom Fields: Font Awesome <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Summary

The Advanced Custom Fields: Font Awesome Field plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts that execute in a victim's browser.

Timeline

1. Feb 19, 2026, 4:36 AM UTCCVE published
2. Feb 24, 2026, 1:31 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Apr 8, 2026, 5:20 PM UTCRecord last updated

Affected versions

• mattkeys Advanced Custom Fields: Font Awesome Field

  through 5.0.1

References 10