Justin Kruit vulnerabilities and threats

CVE-2026-66678 is a medium severity vulnerability in the Advanced Custom Fields: Font Awesome Field plugin by Justin Kruit. It involves missing authorization (CWE-862) in versions up to and including 6.1.1. This flaw could allow users with limited privileges to access functionality or data they should not be authorized to use. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advanced Custom Fields: Font Awesome Field allows Stored XSS. This issue affects Advanced Custom Fields: Font Awesome Field: from n/a through 5.0.2.

The Advanced Custom Fields: Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.0.2. This is due to insufficient input validation of JSON field values and unsafe client-side HTML construction in the update_preview() JavaScript function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.