PT-2026-56316 · WordPress · Sympl Repeater For Acf/Elementor

Zast.Ai · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-10570

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sympl Repeater for ACF and Elementor versions prior to 2.4

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the symp arfe replace content() function. The function utilizes str replace() to insert raw ACF field values, obtained via get field(), directly into Elementor-rendered HTML without proper escaping. This allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update to a version newer than 2.3. As a temporary mitigation, restrict user permissions to prevent users with Author-level access from modifying ACF repeater field values.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-10570

Affected Products

Sympl Repeater For Acf/Elementor

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-10570 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/daa38c2c-9992-400b-acef-dcd37f9c7269?source=cve · Note
• https://plugins.trac.wordpress.org/browser/acf-repeater-for-elementor/tags/2.3/sympl-repeater-for-acf-and-elementor.php#L99 · Note
• https://t.me/CVEtracker/59337 · Telegram Post
• https://t.me/cveNotify/190879 · Telegram Post
• https://t.me/cveNotify/191049 · Telegram Post
• https://plugins.trac.wordpress.org/browser/acf-repeater-for-elementor/tags/2.3/sympl-repeater-for-acf-and-elementor.php#L179 · Note