CVE-2026-10570 describes a stored cross-site scripting vulnerability in the Sympl Repeater for ACF and Elementor plugin for WordPress. The issue arises because the symp_arfe_replace_content() function uses str_replace() to insert raw ACF repeater field values directly into Elementor-rendered HTML without proper escaping or sanitization. This allows authenticated attackers with Author-level privileges or higher to inject arbitrary JavaScript code into pages, which executes when other users view the affected pages. The vulnerability affects all versions up to and including 2.3. No official patch or remediation level has been published yet.

An attacker with Author-level access or above can exploit this vulnerability to inject malicious scripts into WordPress pages via ACF repeater fields. These scripts execute in the context of users viewing the compromised pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider disabling or limiting use of the Sympl Repeater for ACF and Elementor plugin. Monitor vendor channels for updates and apply patches promptly once released.