Table Field Add-on for ACF and SCF
Table Field Add-on for ACF and SCF has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2016 and 2026; all 4 are fixed as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10. 2026 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 4 of the records (100%).
Every one of the 4 issues recorded for Table Field Add-on for ACF and SCF has a vendor fix available, so running the current release closes all known holes.
4 independent researchers contributed these findings, one record each. Table Field Add-on for ACF and SCF is installed on roughly 50,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-78068Table Field Add-on for ACF and SCF <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content
Read the full analysisVulnerability Records
Table Field Add-on for ACF and SCF
Author
Johann Heyne
The Table Field plugin is an Add-on and enhances the functionality of the Advanced Custom Fields (ACF) plugin and the Secure Custom Fields plugin with easy-to-edit tables. This plugin requires the Advanced Custom Fields plugin or the Secure Custom Fields plugin! The table field works also with the ACF repeater and flexible field types and supports the ACF Blocks for Gutenberg Features Table Header (Option) Table Caption (Option) Support for ACF Gutenberg blocks Add and remove table columns and rows Change order of columns and rows by dragging To move to the next cells editor press key: tab To move to the previous cells editor press key: shift + tab Translations English – default, always included German: Deutsch – immer dabei! Danish: Dansk – altid der! Polish: Polski – zawsze tam jest! Note: Please contribute your language to the plugin to make it even more useful. PRO There is also a Table Field Pro Add-on for the Advanced Custom Fields and Secure Custom Fields plugins. The Pro plugin offers a highly configurable and flexible table interface. It provides support for 29 languages: Albanian, Chinese, Czech, Danish, Dutch, Finnish, French, (France), German, Greek, Hebrew, Hindi, Icelandic, Italian, Japanese, Korean, Lithuanian, Norwegian, (Bokmål), Polish, Portuguese, Russian, Serbian, Slovak, Slovenian, Spanish, Swedish, Turkish, Ukrainian, Vietnamese Table data import for CSV and TSV Table reset Fullscreen table editing Pre-definable custom default table Pre-definable table editing functionalities Pre-definable minimum and maximum amount of rows and columns Pre-definable style choices for the table and all parts of the table Custom column widths for the edditing table Table foot Stub column Disable moving individual columns Optional table cell content editing by configurable WordPress editor Rowspan and colspan Build in WordPress shortcode Ouput – hide table when empty Support for Polylang and Polylang Pro Integrated WP GraphQL support Configurable Sanitizing The Pro plugin can run alongside the free version, allowing you to convert existing fields from the Table field type to Table Pro whenever needed. to the plugin website
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C