CVE-2026-78068: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in jonua Table Field Add-on for ACF and SCF

CVE-2026-78068 is a stored cross-site scripting vulnerability in the jonua Table Field Add-on for ACF and SCF WordPress plugin. The flaw exists in all versions up to 1.3.35 due to improper neutralization of input during web page generation, specifically in table cell content. Authenticated attackers with Contributor-level privileges or above can inject arbitrary scripts that execute in the context of users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into table cells. These scripts execute in the browsers of users who view the infected pages, potentially allowing theft of user credentials, session tokens, or performing actions on behalf of the victim user. The vulnerability does not affect availability but impacts confidentiality and integrity.

No official patch or fix is currently documented. Users should check the vendor's advisory for updates. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Table Field Add-on for ACF and SCF plugin if possible to prevent exploitation.