CVE-2026-6415: WordPress Font Awesome Plugin XSS Flaw

CVE-2026-6415 Overview

CVE-2026-6415 is a stored Cross-Site Scripting (XSS) vulnerability in the Advanced Custom Fields: Font Awesome plugin for WordPress, affecting all versions up to and including 5.0.2. The flaw stems from insufficient input validation of JSON field values combined with unsafe client-side HTML construction in the update_preview() JavaScript function. Authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts that execute when users access affected pages. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated attackers with low-privilege Subscriber accounts can persist malicious JavaScript on WordPress pages, enabling session theft, administrative action hijacking, and site defacement against any visitor who loads the injected page.

Affected Products

Advanced Custom Fields: Font Awesome plugin for WordPress versions 5.0.2 and earlier
WordPress installations using the ACF Font Awesome integration
Any WordPress site permitting Subscriber-or-higher account registration with this plugin installed

Discovery Timeline

2026-05-15 - CVE-2026-6415 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-6415

Vulnerability Analysis

The vulnerability resides in the plugin's client-side JavaScript file input-v6.js, specifically in the update_preview() function. The function constructs HTML dynamically from JSON field values without sanitizing or encoding the input. When an authenticated user submits crafted Font Awesome field data, the malicious payload is stored in the WordPress database. The payload then renders as executable script whenever the affected field appears in a rendered page.

Stored XSS vulnerabilities are persistent. Unlike reflected XSS, the injected script runs for every visitor who loads the compromised resource. This expands the attack surface from a single victim to every user that browses the affected content, including administrators with elevated privileges.

Root Cause

The root cause is twofold. First, the plugin fails to validate or sanitize JSON field values supplied by authenticated users. Second, the update_preview() JavaScript function builds DOM content by concatenating attacker-controlled strings into HTML rather than using safe DOM APIs such as textContent or properly escaped attribute assignment. This combination allows raw <script> tags or event handler attributes to reach the browser parser.

Attack Vector

Exploitation requires an authenticated session with Subscriber-level privileges, which is the lowest privileged WordPress role. The attacker submits a crafted payload through a Font Awesome field, which is then stored. When any user, including administrators, navigates to a page containing the injected field, the script executes in the visitor's browser context. The Scope:Changed CVSS component reflects that the executed script affects resources beyond the vulnerable component, including session cookies for the entire WordPress domain.

The vulnerability mechanism is described in the plugin source at assets/js/input-v6.js lines 11–12. See the Wordfence Vulnerability Report and the WordPress Changeset #3525840 for the corrective patch details.

Detection Methods for CVE-2026-6415

Indicators of Compromise

Font Awesome ACF field values containing HTML tags such as <script>, <img onerror=...>, or javascript: URI schemes
Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing pages with Font Awesome fields
New or modified WordPress administrator accounts created shortly after a Subscriber account interacts with the plugin
Subscriber-role accounts modifying ACF field data when their role does not require it

Detection Strategies

Review the wp_postmeta and wp_options tables for ACF Font Awesome field values containing HTML or script syntax
Inspect WordPress audit logs for low-privilege users submitting or editing ACF Font Awesome fields
Scan rendered page output for unexpected inline JavaScript originating from Font Awesome preview elements
Monitor JavaScript console errors that may indicate malformed payload execution attempts

Monitoring Recommendations

Enable WordPress activity logging plugins to track field modifications by user role
Deploy a Content Security Policy (CSP) and alert on violations involving inline script execution
Forward web server and WordPress logs to a centralized analytics platform for correlation of low-privilege actions with admin session activity
Alert on creation of new administrator accounts or privilege escalation events following Subscriber field edits

How to Mitigate CVE-2026-6415

Immediate Actions Required

Update the Advanced Custom Fields: Font Awesome plugin to a version newer than 5.0.2 that incorporates WordPress Changeset #3525840
Audit existing ACF Font Awesome field values across all posts and pages for malicious payloads and remove any injected content
Review the user list and remove unnecessary Subscriber accounts, particularly those created during open registration periods
Force password resets and invalidate active sessions for administrator accounts that may have viewed compromised pages

Patch Information

The vendor released a fix tracked in WordPress Changeset #3525840. The patch addresses the unsafe HTML construction in update_preview() within assets/js/input-v6.js. Site administrators should apply the patched plugin version through the WordPress plugin dashboard or via WP-CLI.

Workarounds

Disable the Advanced Custom Fields: Font Awesome plugin until the patched version can be deployed
Restrict WordPress user registration to prevent untrusted users from obtaining Subscriber accounts
Implement a strict Content Security Policy that disallows inline scripts on administrative pages
Place the WordPress administration interface behind a Web Application Firewall (WAF) with XSS payload filtering enabled

bash

# Update the plugin via WP-CLI once a patched version is available
wp plugin update advanced-custom-fields-font-awesome

# Disable the plugin as a temporary workaround
wp plugin deactivate advanced-custom-fields-font-awesome

# Disable open user registration to limit attacker access
wp option update users_can_register 0