CVE-2025-12067: WordPress Table Field Add-on XSS Flaw

CVE-2025-12067 Overview

CVE-2025-12067 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Table Field Add-on for Advanced Custom Fields (ACF) and Secure Custom Fields (SCF) plugin for WordPress. The flaw exists in all versions up to and including 1.3.30. The plugin fails to properly sanitize input and escape output within the Table Cell Content field. Authenticated attackers with Author-level access or above can inject arbitrary JavaScript that executes when users view affected pages.

Critical Impact
Authenticated attackers with Author-level privileges can inject persistent JavaScript payloads that execute in the browser context of every visitor, enabling session hijacking, credential theft, and administrative account takeover.

Affected Products

Table Field Add-on for ACF and SCF plugin for WordPress (versions ≤ 1.3.30)
WordPress installations using Advanced Custom Fields with the Table Field Add-on
WordPress installations using Secure Custom Fields with the Table Field Add-on

Discovery Timeline

2026-01-06 - CVE-2025-12067 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12067

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting (XSS) issue classified under [CWE-79]. The Table Field Add-on extends ACF and SCF custom field functionality by providing a tabular data structure that authors can populate through the WordPress admin interface. The plugin accepts user-supplied content for individual table cells but does not sanitize this input before storing it or escape it before rendering it on the front end.

An attacker with Author-level access or higher can insert JavaScript payloads into table cell content. The payload is persistently stored in the WordPress database. When any visitor or administrator loads a page containing the malicious table, the script executes in their browser context. This enables session token theft, forced administrative actions through the WordPress REST API, and persistent backdoors via plugin or user creation.

Root Cause

The root cause is insufficient input sanitization combined with missing output escaping in the Table Cell Content handling logic. WordPress provides functions such as wp_kses_post() for sanitizing rich content and esc_html() or esc_attr() for safe output rendering. The vulnerable plugin code path bypasses these protections when processing cell values. The vendor addressed the issue in changeset 3386339 on the WordPress plugin repository.

Attack Vector

The attack vector is network-based and requires authentication at the Author level or above. The scope is changed because the injected script executes against any user viewing the affected page, including higher-privileged administrators. Exploitation does not require user interaction beyond visiting a page that contains the malicious table content. The vulnerability mechanism is described in the Wordfence Vulnerability Report and the corresponding patch is visible in the WordPress Plugin Changeset.

Detection Methods for CVE-2025-12067

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handler attributes (onerror, onload, onclick) stored in wp_postmeta entries associated with ACF or SCF table fields
Outbound HTTP requests from visitor browsers to attacker-controlled domains when rendering pages containing the Table Field plugin output
New WordPress administrator accounts or plugin installations performed by Author-level users
Browser console errors or Content Security Policy violations on pages containing custom table fields

Detection Strategies

Query the wp_postmeta table for meta_value entries linked to Table Field instances and grep for <script, onerror=, onload=, and javascript: patterns
Review WordPress audit logs for Author-level users modifying posts or pages that contain Table Field shortcodes or blocks
Deploy a web application firewall rule that inspects POST requests to /wp-admin/post.php and /wp-json/wp/v2/ endpoints for script payloads in custom field parameters

Monitoring Recommendations

Monitor for unauthorized privilege escalation events such as user_register and set_user_role actions originating from Author-level sessions
Alert on installation of new plugins or modifications to wp_options immediately following page edits by non-administrative users
Enable a strict Content Security Policy and log violation reports to identify in-the-wild exploitation attempts

How to Mitigate CVE-2025-12067

Immediate Actions Required

Update the Table Field Add-on for ACF and SCF plugin to the version released after 1.3.30 that contains the fix from changeset 3386339
Audit all existing posts and pages using Table Field instances for previously stored XSS payloads and remove malicious content
Review Author-level and Editor-level accounts for unauthorized activity and rotate credentials for any accounts showing suspicious behavior

Patch Information

The vendor published a fix in changeset 3386339 on the WordPress plugin repository. Site administrators should apply the update through the WordPress admin Plugins screen or via WP-CLI. Verify the installed plugin version after update to confirm remediation.

Workarounds

Restrict Author-level and higher accounts to trusted users only and enforce multi-factor authentication on all editorial accounts
Deactivate the Table Field Add-on plugin until patching is complete if business operations allow it
Deploy a web application firewall with rules blocking script tags and JavaScript event handlers in custom field submissions

bash

# Update the plugin via WP-CLI
wp plugin update acf-table-field --version=latest
wp plugin list --name=acf-table-field --fields=name,status,version

# Audit postmeta for potential stored XSS payloads
wp db query "SELECT post_id, meta_key FROM wp_postmeta WHERE meta_value REGEXP '<script|onerror=|onload=|javascript:';"