Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

WordPress Font Awesome Field plugin allows hackers to inject malicious scripts

CVE-2025-14983
Summary

A security flaw in the WordPress Font Awesome Field plugin makes it possible for hackers to inject malicious code into website visitors' browsers. This can happen if a website is using an outdated version of the plugin. Update the plugin to the latest version to fix the issue.

Original title
The Advanced Custom Fields: Font Awesome Field plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 5.0.1 due to insufficient input sanitization and outp...
Original description
The Advanced Custom Fields: Font Awesome Field plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts that execute in a victim's browser.
nvd CVSS3.1 6.4
Vulnerability type
CWE-79 Cross-site Scripting (XSS)
Published: 19 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026