PT-2025-16511 · Unknown · Advanced Custom Fields Pro

Dimas Maulana · Published 2025-04-15 · Updated 2025-04-16 · CVE-2025-26746

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions NotFound Advanced Custom Fields: Link Picker Field versions 1.2.8 and earlier

Description The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting (XSS). This enables attackers to inject malicious scripts into websites, potentially leading to unauthorized actions or data theft. The problem affects the Link Picker Field in Advanced Custom Fields.

Recommendations For versions 1.2.8 and earlier, update to a version later than 1.2.8 to resolve the issue. As a temporary workaround, consider disabling the Link Picker Field until a patch is available. Restrict access to the Link Picker Field to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-26746

Affected Products

Advanced Custom Fields Pro

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-26746 · Security Note
• https://twitter.com/cybercronai/status/1912517716860170536 · Twitter Post
• https://twitter.com/CVEnew/status/1912359823875723330 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/acf-link-picker-field/vulnerability/wordpress-advanced-custom-fields-link-picker-field-plugin-1-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/acf-link-picker-field/vulnerability/wordpress-advanced-custom-fields-link-picker-field-plugin-1-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note