CVE-2026-10570: Stored XSS in Sympl Repeater for ACF and Elementor WordPress Plugin

Technical summary

CVE-2026-10570 is a stored XSS vulnerability in the symp_arfe_replace_content() function within the Sympl Repeater for ACF and Elementor plugin. The function uses str_replace() to substitute raw ACF field values retrieved via get_field() directly into Elementor-rendered HTML without output escaping. ACF's get_field() returns unescaped data by default, and the plugin makes no attempt to sanitize or escape this data before inserting it into the DOM. This allows authenticated users with Author role or above to craft malicious payloads in repeater field values that persist in the database and execute in the browsers of all subsequent visitors to the affected page. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

Compromised WordPress sites become vectors for malware distribution, credential theft, and session hijacking. Attackers with author privileges can silently inject keyloggers or redirect users to phishing pages without detection by most site administrators. If the site processes sensitive data or handles customer information, the injected scripts can capture and exfiltrate that data. Trust erosion among site visitors is significant—particularly for e-commerce or membership sites where user confidence is critical. Remediation delays multiply the exposure window and potential victim count.

Affected systems

The Sympl Repeater for ACF and Elementor plugin is affected in all versions up to and including 2.3. WordPress installations running this plugin are at risk if any user with Author role or above (including Contributors with elevated permissions) has access to create or edit pages containing ACF repeater fields. Multisite WordPress networks may face broader attack surface if the plugin is network-activated or if multiple sites use it.

Exploitability

Exploitation requires authentication and Author-level privileges or higher, which moderately restricts the attack surface compared to unauthenticated vulnerabilities. However, many WordPress sites operate with loose contributor management—freelancers, agency staff, and contractors often retain author access after engagements end. Once injected, the malicious payload is stored and automatically executes for every visitor without additional attacker interaction. This makes the vulnerability a persistent, scalable attack vector with high confidence of success against any site user.

Remediation

Update the Sympl Repeater for ACF and Elementor plugin to a patched version beyond 2.3 as soon as a fix is released by the vendor. Verify against the official plugin repository or vendor advisory for the specific version number. In the interim, disable or restrict access to ACF repeater fields in Elementor for non-administrative users, or temporarily deactivate the plugin if it is not critical to site operations. Audit existing repeater field values in the database for signs of suspicious script tags or JavaScript patterns.

Patch guidance

Monitor the Sympl Repeater for ACF and Elementor plugin repository and vendor announcements for a security update addressing this vulnerability. Test the patched version in a staging environment before production deployment to confirm compatibility with your theme and other plugins. The fix should include proper output escaping (e.g., using wp_kses_post() or esc_html() as appropriate for the context) in the symp_arfe_replace_content() function and sanitization of ACF field values before insertion into HTML. Verify the patch against the official CVE advisory before applying.

Detection guidance

Search your WordPress database for repeater field entries containing script tags, event handlers (onload, onerror, onclick), or encoded JavaScript patterns. Monitor user activity logs for author-level edits to pages using the Sympl Repeater plugin, especially from unfamiliar or recently created user accounts. Deploy a Web Application Firewall (WAF) rule to detect and log attempts to POST or PUT data containing script tags into ACF repeater fields. On the client side, check browser console for unexpected script execution errors or CSP violations when viewing pages with repeater fields. If you operate a security monitoring service, flag any pages where repeater field content differs between database and rendered output.

Why prioritize this

This vulnerability warrants prompt but not emergency remediation. The CVSS 6.4 MEDIUM score reflects the authentication requirement, which meaningfully reduces risk compared to unauthenticated XSS. However, the stored nature of the attack, combined with the prevalence of WordPress sites with loose permission management, creates real operational risk. The vulnerability is not listed in the CISA KEV catalog, suggesting no active weaponized exploits have been publicly disclosed—prioritize it as a high-priority patch window task rather than an incident response trigger. Organizations with strict author permission controls can defer slightly; those with contributor-heavy workflows should treat it as urgent.

Risk score, explained

CVSS 3.1 score of 6.4 (MEDIUM) reflects: AV:N (network-accessible plugin affecting all site visitors), AC:L (no special conditions required for exploitation), PR:L (requires authenticated Author role or above, a meaningful but not extreme barrier), UI:N (no user interaction needed once payload is injected), S:C (scope change—injected script affects other users' sessions), C:L (confidentiality impact via session theft or credential capture), I:L (integrity impact via page defacement or malware injection), A:N (no availability impact). The authentication requirement prevents a higher score; the stored XSS persistence and cross-user impact prevent a lower one.

Frequently asked questions