CVE-2026-49044: ACF Font Awesome Field Stored XSS Flaw

CVE-2026-49044 Overview

CVE-2026-49044 is a stored Cross-Site Scripting (XSS) vulnerability in the Justin Kruit Advanced Custom Fields: Font Awesome Field WordPress plugin. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. It affects all plugin versions from initial release through 5.0.2.

Authenticated attackers with low privileges can inject malicious scripts that persist in the database. The payload executes in the browser of any user who views the affected page, enabling session theft, credential harvesting, and administrative account takeover when targeting privileged users.

Critical Impact

Stored XSS payloads injected through the Font Awesome Field plugin execute in browsers of site visitors and administrators, enabling session hijacking and privilege escalation across the WordPress installation.

Affected Products

• Justin Kruit Advanced Custom Fields: Font Awesome Field plugin (WordPress)
• All versions from initial release through 5.0.2
• WordPress sites running the plugin with Advanced Custom Fields installed

Discovery Timeline

• 2026-05-27 - CVE-2026-49044 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-49044

Vulnerability Analysis

The vulnerability resides in how the Advanced Custom Fields: Font Awesome Field plugin processes and renders user-supplied input. The plugin fails to sanitize input data before storing it and does not properly encode output when rendering field content in web pages.

An authenticated user with permission to edit custom fields can submit crafted input containing JavaScript payloads. The plugin stores this input without neutralizing dangerous characters. When the affected field is later displayed, the browser interprets the stored content as executable script.

The attack requires user interaction, meaning a victim must visit a page containing the malicious field content. Because the impact crosses a security scope boundary, the injected script can affect users beyond the attacker's privilege level, including site administrators.

Root Cause

The root cause is missing or insufficient input sanitization combined with unsafe output encoding when the plugin renders Font Awesome field values. The plugin trusts authenticated user input and does not apply WordPress sanitization functions such as wp_kses() or escape output with esc_html() and esc_attr() before rendering.

Attack Vector

Exploitation requires network access to the WordPress admin interface and a low-privileged authenticated account (such as Contributor or Editor). The attacker creates or modifies content using the vulnerable Font Awesome Field, embedding a JavaScript payload within the field value.

When any user, including administrators, views the page containing the injected field, the browser executes the attacker's script in the context of the WordPress site. See the Patchstack WordPress Vulnerability advisory for technical details.

Detection Methods for CVE-2026-49044

Indicators of Compromise

• Unexpected <script> tags, javascript: URIs, or event handler attributes (onerror, onload) stored in wp_postmeta records associated with Font Awesome Field values.
• Outbound HTTP requests from administrator browsers to unknown external domains shortly after viewing pages with custom fields.
• New or modified WordPress administrator accounts created without corresponding audit log entries from legitimate admins.

Detection Strategies

• Query the WordPress database for postmeta entries containing script tags or JavaScript event handlers within fields managed by the Advanced Custom Fields: Font Awesome Field plugin.
• Deploy a Web Application Firewall (WAF) rule to inspect POST requests to admin-ajax.php and post editor endpoints for XSS payload patterns targeting ACF field names.
• Review WordPress audit logs for content modifications by low-privileged users that include HTML or script content in custom field submissions.

Monitoring Recommendations

• Enable verbose logging on the WordPress installation and forward authentication and content modification events to a centralized log platform for correlation.
• Monitor browser-side Content Security Policy (CSP) violation reports to surface attempts to load unauthorized inline or external scripts.
• Track plugin version inventory across all WordPress sites to identify instances running 5.0.2 or earlier.

How to Mitigate CVE-2026-49044

Immediate Actions Required

• Update the Advanced Custom Fields: Font Awesome Field plugin to a version newer than 5.0.2 once the vendor publishes a fix.
• Audit existing custom field content for stored script payloads and remove any malicious entries from the database.
• Restrict Contributor and Editor role assignments to trusted users only, since exploitation requires authenticated access.

Patch Information

At the time of publication, the advisory indicates the issue affects versions through 5.0.2. Refer to the Patchstack advisory for the latest patch availability and apply the fixed release as soon as it is published.

Workarounds

• Deactivate and remove the Advanced Custom Fields: Font Awesome Field plugin until a patched version is available.
• Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Deploy a WordPress-aware WAF with rulesets that block XSS patterns in ACF-related parameters and admin POST requests.

# Example Content Security Policy header for WordPress (add via .htaccess or server config)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';"