Table Field Add-on for ACF and SCF <= 1.3.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content
medium
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Cell Content in all versions up to, and including, 1.3.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and ab...
- CVSS:
- 6.4
- Affected:
- up to 1.3.30
- Fixed in:
- 1.3.31
- Disclosed:
- Jan 5, 2026
CVE-2025-12067 on NVD →
Advanced Custom Fields: Table Field < 1.1.13 - Authenticated Stored Cross-Site Scripting
medium
The Advanced Custom Fields: Table Field plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions before 1.1.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user ac...
- CVSS:
- 6.4
- Affected:
- up to 1.1.13
- Fixed in:
- 1.1.13
- Disclosed:
- Jul 13, 2016
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database