CVE-2025-50041: ACF Blocks Suite Stored XSS Vulnerability

CVE-2025-50041 Overview

CVE-2025-50041 is a stored Cross-Site Scripting (XSS) vulnerability in the WP Engine Gutenberg Blocks – ACF Blocks Suite plugin for WordPress. The flaw affects all plugin versions up to and including 2.6.11. Authenticated contributors can inject persistent JavaScript payloads that execute in the browsers of site visitors and administrators. The vulnerability is classified under [CWE-79] for improper neutralization of input during web page generation.

Critical Impact
Attackers with low-privileged authenticated access can store malicious scripts in WordPress content. When rendered, these scripts run in an administrator's session context and can be used to hijack accounts or pivot into the site backend.

Affected Products

WP Engine Gutenberg Blocks – ACF Blocks Suite plugin for WordPress
All versions from initial release through 2.6.11
WordPress sites using the acf-blocks plugin with contributor-level or higher user accounts

Discovery Timeline

2025-06-20 - CVE-2025-50041 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-50041

Vulnerability Analysis

The vulnerability originates in the ACF Blocks Suite plugin's handling of user-supplied block content. The plugin fails to properly sanitize input before rendering it within generated HTML output. Authenticated users with permission to edit posts or blocks can embed arbitrary JavaScript that persists in the database. When any user views the affected page, the browser executes the stored payload in the site's origin context.

Because the scope is marked as changed, injected scripts run in the context of a different security scope than the attacker's own. This enables privilege boundary crossing, particularly when an administrator loads the poisoned content in the WordPress admin dashboard.

Root Cause

The plugin does not enforce output encoding or input sanitization on block attributes rendered server-side. Content passed through ACF fields or block markup reaches the DOM without HTML entity escaping. This is a classic instance of improper neutralization as described in [CWE-79].

Attack Vector

Exploitation requires an authenticated account with content-editing privileges and a subsequent user interaction, such as an administrator viewing the malicious post or block preview. The attacker submits a block containing a JavaScript payload through a vulnerable ACF field. When the page renders, the script executes and can perform actions including session token theft, forced administrative actions via nonce reuse, or injection of persistent backdoors through the WordPress theme or plugin editor. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-50041

Indicators of Compromise

WordPress posts, pages, or block content containing <script> tags, onerror=, onload=, or javascript: URIs inside ACF block attributes
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after loading edited content
New administrator accounts, modified user roles, or unauthorized changes to plugin and theme files following contributor activity

Detection Strategies

Audit the wp_posts and wp_postmeta tables for suspicious HTML event handlers or encoded JavaScript within ACF block markup
Review WordPress activity logs for content edits from contributor or author accounts that immediately preceded administrator sessions
Correlate web server access logs with editorial workflows to identify preview or publish events tied to script execution

Monitoring Recommendations

Enable a Web Application Firewall (WAF) with XSS signatures tuned for WordPress block editor payloads
Monitor for outbound connections from browsers accessing /wp-admin/ to non-approved external domains
Track plugin version inventories across managed WordPress sites to identify installations still running acf-blocks 2.6.11 or earlier

How to Mitigate CVE-2025-50041

Immediate Actions Required

Update the Gutenberg Blocks – ACF Blocks Suite plugin to a version later than 2.6.11 as soon as a patched release is available from WP Engine
Audit contributor, author, and editor accounts and remove or restrict any that are not actively required
Review recently created or modified posts containing ACF blocks for injected script content and purge malicious entries

Patch Information

At the time of publication, the vulnerability affects versions up to and including 2.6.11. Administrators should consult the Patchstack Vulnerability Report for the latest fixed version and apply the update through the WordPress plugin manager.

Workarounds

Temporarily deactivate the acf-blocks plugin on production sites until a patched version is installed
Restrict content editing privileges to trusted administrators only, eliminating contributor and author access to ACF-backed blocks
Deploy a WAF rule set that blocks HTML event handler attributes and inline JavaScript within POST bodies submitted to /wp-admin/post.php and the block editor REST endpoints

bash

# Configuration example: restrict ACF block editing to administrators via mu-plugin
add_filter('acf/settings/capability', function() {
    return 'manage_options';
});