Threat database

The Table Field Add-on for ACF and SCF WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.3.35. Authenticated users with Contributor-level access or higher can inject malicious scripts via table cell content, which execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.

The Table Field Add-on for ACF and SCF WordPress plugin versions up to 1.4.1-RC2 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with subscriber-level access or higher can inject malicious scripts via the Table Field Value. These scripts execute whenever a user views the affected page, potentially compromising user interactions. The vulnerability arises from insufficient input sanitization and output escaping.

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Cell Content in all versions up to, and including, 1.3.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.