CVE-2025-12067: WordPress Table Field Add-on XSS Flaw

CVE-2025-12067 Overview

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the Table Cell Content in all versions up to, and including, 1.3.30. This vulnerability exists due to insufficient input sanitization and output escaping, allowing authenticated attackers with Author-level access and above to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the context of victim users' browsers, potentially leading to session hijacking, credential theft, or defacement of WordPress sites.

Affected Products

• Table Field Add-on for ACF and SCF plugin for WordPress versions up to and including 1.3.30
• WordPress installations using the vulnerable plugin with Author-level or higher user accounts

Discovery Timeline

• 2026-01-06 - CVE-2025-12067 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-12067

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability affects the Table Field Add-on for ACF (Advanced Custom Fields) and SCF (Simple Custom Fields) plugin for WordPress. The vulnerability stems from improper handling of user-supplied content within table cells, where input is not adequately sanitized before storage and output is not properly escaped when rendered on the page.

When an authenticated user with Author-level privileges or higher inserts malicious JavaScript code into a table cell, the plugin fails to neutralize the script content. This malicious payload is then stored in the WordPress database and executed in the browsers of any users who view pages containing the injected table content.

The scope of this vulnerability extends beyond the immediate application context (Changed scope in CVSS terms), meaning the injected scripts can impact resources outside the vulnerable plugin's domain, potentially affecting the broader WordPress installation and its users.

Root Cause

The root cause of CVE-2025-12067 is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin fails to implement proper input validation and output encoding mechanisms for table cell content. Specifically, the vulnerability exists because:

1. Insufficient Input Sanitization: User-supplied data in table cells is not properly filtered to remove or neutralize potentially malicious script content before being stored in the database.

2. Inadequate Output Escaping: When table content is rendered on the frontend or backend, the plugin does not apply proper HTML entity encoding or JavaScript escaping, allowing stored scripts to execute as active code.

Attack Vector

The attack is network-based and requires low complexity to execute. An attacker needs valid WordPress credentials with at least Author-level privileges to exploit this vulnerability. The attack flow proceeds as follows:

1. The attacker authenticates to the WordPress site with Author-level or higher credentials
2. The attacker creates or edits content using the Table Field Add-on
3. Within a table cell, the attacker inserts a malicious JavaScript payload
4. The payload bypasses insufficient sanitization and is stored in the database
5. When any user (including administrators) views the page containing the injected table, the malicious script executes in their browser context

The attack requires no user interaction beyond normal page viewing, making it particularly dangerous in multi-author WordPress environments. Successful exploitation can lead to session hijacking, administrative account compromise, or delivery of secondary payloads to site visitors.

Detection Methods for CVE-2025-12067

Indicators of Compromise

• Presence of unexpected JavaScript code within table field content in the WordPress database
• Unusual <script> tags, event handlers (e.g., onerror, onload, onclick), or encoded payloads in ACF/SCF table data
• Reports from users experiencing unexpected browser behavior or redirects when viewing certain pages
• Anomalous outbound network requests originating from WordPress pages containing table content

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block unauthorized inline script execution
• Regularly audit ACF and SCF table field content in the WordPress database for suspicious patterns including script tags and JavaScript event handlers
• Deploy Web Application Firewall (WAF) rules to monitor and log attempts to insert script content into table fields
• Enable WordPress debug logging and monitor for JavaScript-related errors or unusual content rendering

Monitoring Recommendations

• Configure SentinelOne to monitor for suspicious browser-based script execution patterns on WordPress server endpoints
• Set up alerting for database modifications to ACF/SCF meta tables that contain script-like content patterns
• Monitor user activity logs for Author-level accounts making unusual edits to table field content
• Implement real-time scanning of WordPress content for XSS payload signatures

How to Mitigate CVE-2025-12067

Immediate Actions Required

• Update the Table Field Add-on for ACF and SCF plugin to a patched version beyond 1.3.30
• Audit existing table field content in your WordPress database for any injected scripts or suspicious content
• Review user accounts with Author-level or higher permissions and remove unnecessary access
• Implement Content Security Policy headers to mitigate the impact of any existing XSS payloads

Patch Information

The vendor has released a security update addressing this vulnerability. The patch can be reviewed in the WordPress Plugin Changeset. Additional vulnerability details are available in the Wordfence Vulnerability Report.

WordPress site administrators should update the plugin through the WordPress admin dashboard or by downloading the latest version directly from the WordPress plugin repository.

Workarounds

• Temporarily restrict Author-level and higher user access until the plugin is updated
• Implement server-side input validation to strip script tags and event handlers from table field submissions
• Deploy a Web Application Firewall (WAF) with XSS protection rules to filter malicious input
• Consider temporarily disabling the Table Field Add-on plugin if it is not critical to site operations

# WordPress CLI command to update the plugin
wp plugin update table-field-add-on-for-acf-and-scf --force

# Verify plugin version after update
wp plugin get table-field-add-on-for-acf-and-scf --field=version