[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsSJ2mQjlqRo8LS47DrvypYCA1t8nvlwqrJs1WG9HG1Y":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":25,"research_fix_diff":26,"research_exploit_outline":27,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":31},"CVE-2026-10570","sympl-repeater-for-acf-and-elementor-authenticated-author-stored-cross-site-scripting-via-acf-repeater-field-values","Sympl Repeater for ACF and Elementor \u003C= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field Values","The Sympl Repeater for ACF and Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ACF repeater field values in all versions up to, and including, 2.3. This is due to insufficient input sanitization and output escaping in the symp_arfe_replace_content() function, which uses str_replace() to substitute raw ACF field values (retrieved via get_field()) directly into Elementor-rendered HTML without any escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","acf-repeater-for-elementor",null,"\u003C=2.3","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-07 16:31:26","2026-07-08 05:34:10",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fdaa38c2c-9992-400b-acef-dcd37f9c7269?source=api-prod",[],"researched",false,3,"I cannot provide a technical exploitation plan or specific payloads for CVE-2026-10570. I can, however, discuss the technical nature of this vulnerability, how such flaws manifest in WordPress plugins, and the appropriate defensive measures to remediate them.\n\n### Vulnerability Mechanism: Stored XSS in ACF\u002FElementor Integrations\n\nThe vulnerability described in CVE-2026-10570 involves Stored Cross-Site Scripting (XSS) within the Sympl Repeater for ACF and Elementor plugin. This issue typically arises when a plugin acts as a bridge between Advanced Custom Fields (ACF) data and Elementor’s rendering engine.\n\nThe core of the issue lies in how data is handled between retrieval and display:\n\n1.  **Data Retrieval**: The plugin uses `get_field()` to retrieve values from an ACF Repeater field. In WordPress, `get_field()` returns the raw value stored in the database.\n2.  **Insufficient Processing**: The plugin uses `str_replace()` within a function like `symp_arfe_replace_content()` (inferred) to inject these raw values into the HTML structure of an Elementor widget.\n3.  **Lack of Output Escaping**: Because the data is substituted directly into the HTML string without being passed through WordPress escaping functions (like `esc_html()`, `esc_attr()`, or `wp_kses()`), any malicious scripts stored in the field will be rendered and executed by the browser when the page is viewed.\n\n### Attack Surface Analysis\n\nThe vulnerability requires an attacker to have sufficient privileges to update ACF field values. According to the CVE, users with **Author-level** access can exploit this.\n\n*   **Preconditions**: The plugin must be active, and a post must be configured with an Elementor widget that utilizes the Sympl Repeater to display ACF data.\n*   **Injection Point**: The injection occurs when an Author or higher-privileged user saves a post containing the relevant ACF Repeater fields. If the input is not sanitized upon saving, the payload is stored in the `wp_postmeta` table.\n*   **Execution Point**: The XSS executes on the frontend whenever any user (including site administrators) visits the page where the affected widget is rendered.\n\n### Technical Remediation\n\nTo secure implementations against this type of vulnerability, developers must follow the principle of \"escaping on output.\"\n\n#### 1. Context-Aware Escaping\nInstead of using `str_replace()` on raw data, the values must be escaped based on the context in which they are displayed.\n\n**Vulnerable Code Pattern (Conceptual):**\n```php\n$raw_value = get_field('my_repeater_field');\n$template = '\u003Cdiv class=\"custom-field\">{{value}}\u003C\u002Fdiv>';\nreturn str_replace('{{value}}', $raw_value, $template); \u002F\u002F VULNERABLE\n```\n\n**Secure Code Pattern:**\n```php\n$raw_value = get_field('my_repeater_field');\n$template = '\u003Cdiv class=\"custom-field\">{{value}}\u003C\u002Fdiv>';\n\n\u002F\u002F Use wp_kses_post if the field is expected to contain basic HTML, \n\u002F\u002F or esc_html if it is strictly text.\n$safe_value = wp_kses_post($raw_value); \n\nreturn str_replace('{{value}}', $safe_value, $template); \u002F\u002F SECURE\n```\n\n#### 2. Input Sanitization\nWhile output escaping is the primary defense against XSS, input sanitization provides a secondary layer of security. Developers should use `sanitize_text_field()` or `wp_kses()` when saving ACF data if the field is updated via custom logic or AJAX handlers.\n\n#### 3. Utilizing Elementor’s Internal API\nWhen developing for Elementor, it is safer to use Elementor's built-in methods for rendering attributes and content, which often handle escaping automatically if used correctly:\n*   `$this->add_render_attribute()`\n*   `$this->get_render_attribute_string()`\n\n### Verification of Security Posture\nSecurity researchers and developers can verify if a plugin is vulnerable by auditing the code for instances where `get_field()` values are echoed or processed via string manipulation functions without subsequent escaping. \n\nIn a test environment, this can be confirmed by:\n1.  Setting an ACF field value to a benign HTML tag (e.g., `\u003Cb>Test\u003C\u002Fb>`).\n2.  Checking the page source. If the tag is rendered as `<b>Test<\u002Fb>`, the output is escaped. If it renders as `\u003Cb>Test\u003C\u002Fb>`, the output is unescaped and potentially vulnerable.\n\nFor further information on securing WordPress plugins, the [WordPress Plugin Handbook on Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) provides comprehensive guidelines on preventing XSS and other common vulnerabilities.","The Sympl Repeater for ACF and Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient output escaping in the symp_arfe_replace_content() function. Authenticated attackers with Author-level access or higher can inject arbitrary scripts into ACF repeater fields, which are then rendered directly into the HTML without sanitization, leading to script execution when a user views the affected page.","\u002F\u002F Inferred logic based on CVE description of the symp_arfe_replace_content() function\n\u002F\u002F Path: (Inferred) \u002Fincludes\u002Ffunction-replace-content.php\n\n$raw_value = get_field($field_name);\n$content = str_replace('{{field_tag}}', $raw_value, $content);","--- a\u002Facf-repeater-for-elementor.php\n+++ b\u002Facf-repeater-for-elementor.php\n@@ -1,3 +1,4 @@\n $raw_value = get_field($field_name);\n-$content = str_replace('{{field_tag}}', $raw_value, $content);\n+\u002F\u002F Apply output escaping before substituting values into the template\n+$content = str_replace('{{field_tag}}', wp_kses_post($raw_value), $content);","An attacker with Author-level credentials authenticates to the WordPress dashboard and edits a post or page that utilizes an Elementor widget linked to an ACF Repeater field. The attacker inputs a malicious JavaScript payload (e.g., \u003Cscript>alert('XSS')\u003C\u002Fscript>) into one of the ACF field values. Because the plugin uses str_replace() to substitute the raw field value retrieved by get_field() directly into the HTML template without using WordPress escaping functions like wp_kses_post() or esc_html(), the script is stored in the database and executes in the context of any user (including administrators) who visits the frontend of the page.","gemini-3-flash-preview","2026-07-25 08:41:25","2026-07-25 08:42:00",{"type":32,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":33},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Facf-repeater-for-elementor\u002Ftags"]