The Advanced Custom Fields: Font Awesome Field plugin for WordPress suffers from a CWE-79 Cross-Site Scripting vulnerability due to improper neutralization of input during web page generation. Authenticated users with Contributor-level privileges or higher can inject malicious scripts because the plugin does not sufficiently sanitize or escape input before outputting it in web pages. This can lead to script execution in the context of other users' browsers, potentially compromising user sessions or data. The vulnerability affects all versions up to and including 5.0.1. No patch or official fix has been documented in the provided data.

An attacker with Contributor-level or higher access can exploit this vulnerability to execute arbitrary JavaScript in the browsers of other users viewing affected pages. This can lead to theft of session tokens, defacement, or other client-side impacts. The vulnerability does not affect availability and has limited impact on confidentiality and integrity as per the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor for updates from the vendor or plugin author regarding patches or mitigations.