ACF Plugin Stored XSS via Unvalidated Field Definitions

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Advanced Custom Fields WordPress plugin before version 6.8.11 contains a stored cross-site scripting (XSS) vulnerability in its comment handling mechanism. Attackers can inject malicious JavaScript payloads through field definition comments that bypass sanitization controls. When these fields are rendered on pages, the payload executes in the browsers of any visitor or administrator, potentially compromising accounts, stealing session tokens, or redirecting users to malicious sites. This vulnerability affects all WordPress installations using vulnerable ACF versions, with particular risk to multi-user sites and those with high-traffic pages where the compromised fields are displayed.

Casky's 323 mapped skills detect this attack pattern by identifying the underlying MITRE ATT&CK techniques: TA0001 (Initial Access) through compromised plugin distribution and TA0043 (Reconnaissance) for payload testing. Claude AI's extended reasoning analyzes stored XSS signatures including improper input validation in comment fields, attribute injection patterns, and the absence of output encoding on rendered HTML attributes. Practitioners using Casky would observe security findings highlighting unsafe comment processing in plugin code, lack of input sanitization before field definition storage, and unencoded attribute rendering—all behavioral indicators of stored XSS vulnerabilities. These skill-based detections surface the vulnerability chain from comment injection through execution, enabling teams to prioritize patching and implement stricter input validation controls.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-110813.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-110813

Casky has 323 skills that investigate the attack patterns behind CVE-2026-110813. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn