Tassos ACF 3.1.9 for Joomla Fixes Gallery and Map Field Flaws

TL;DR

Tassos released Advanced Custom Fields 3.1.9 for Joomla on Wednesday 4 November 2026, in Free and Pro packages, with two security fixes. The vendor’s words are “Fixed a security flaw in the Gallery field’s image removal” and “Fixed a security flaw in the Map field’s marker labels”. The Map one is a stored cross-site scripting (XSS) flaw: before 3.1.9, marker labels went out to the page unfiltered. Update every Joomla site running ACF below 3.1.9.

This is the Joomla extension by Tassos Marinos. It has nothing to do with Advanced Custom Fields for WordPress, or with the ACF Extended add-on for WordPress that has been in the vulnerability feeds all week with an unauthenticated remote code execution flaw. The two are compared below.

Joomla’s ACF Is Not WordPress’s ACF

Three products share the name, and this week two of them have security news. The Tassos extension is the Joomla one. The ACF Extended CVEs are the WordPress ones.

Scanners, news headlines and vulnerability feeds all shorten the name to “ACF”, so the two get mixed up. A Joomla agency reads “ACF unauthenticated RCE” and panics; a WordPress agency reads “ACF 3.1.9 security release” and goes looking for a version that does not exist on their platform. If you run Joomla, the WordPress CVEs do not apply to you. If you run WordPress, the Tassos release does not apply to you. Agencies with both get both.

On the WordPress side, CVE-2026-120534, published on 3 November 2026 by Wordfence, is an unauthenticated remote code execution flaw in Advanced Custom Fields: Extended PRO up to 0.9.2.6, via the Dynamic Render field type, scored CVSS 3.1 9.8. Before that, on 23 October, WPScan published CVE-2026-94262 and CVE-2026-94268, unauthenticated takeover of non-administrator and administrator accounts through the front-end user update action in 0.9.2.7, fixed in 0.9.2.8, plus CVE-2026-94263, unauthenticated arbitrary shortcode execution via a form success message in 0.9.2.4 to 0.9.2.7. On 27 October Wordfence added CVE-2026-10752, unauthenticated arbitrary attachment deletion up to 0.9.2.6. Our WordPress feed holds eleven ACF Extended CVEs published between 20 and 30 October, plus the 3 November PRO one. Update ACF Extended and ACF Extended PRO to the latest release. We covered ACF Extended’s earlier 9.8 flaw, CVE-2025-13486 when it was being exploited.

The Map Field Marker Label XSS in the Joomla Extension

The Map field in ACF for Joomla lets an editor drop markers on a map, each with a label and an address. Before 3.1.9 those labels and addresses were output as saved, with no filtering. That is a stored cross-site scripting flaw: a label containing a script tag or an event handler is saved once and then runs in the browser of every visitor who views the item, and of every administrator who opens it in the back end.

Who can plant it is whoever can edit an item with a Map field on it: an article, a user profile or any other item with ACF fields. On most sites that is a content editor, which is a lower bar than Super User. Front-end editing and user profile fields push the bar lower still. The payoff for an attacker is the usual one for stored XSS, which is the session of whoever views the marker, and the administrator’s session is the valuable one. We wrote up the same class of flaw in Phoca Gallery’s EXIF data.

In 3.1.9, marker labels and addresses go through Joomla’s InputFilter, which strips scripts and event handlers while allowing harmless HTML such as links. The change is in the Tassos Framework bundled with ACF (the system plugin “nrframework”), which moves from 6.1.39 to 6.1.51. The Map field plugin itself only changed its version headers. Tassos does not call it XSS; that is our description of what the change fixes. The Map field ships in Free and Pro, so every edition is affected.

The Gallery Field Image Removal Fix

The Gallery field ships only in ACF Pro. The vendor says 3.1.9 “Fixed a security flaw in the Gallery field’s image removal” and says nothing else about it. We have not been able to read the 3.1.9 Pro package, and the vendor has not said who could trigger the flaw or what could be removed, so we will not guess.

What we can see is the shared framework code, which is in the Free package too. 3.1.9 adds a check that an image can only be removed or processed for a gallery when it is one of that gallery’s stored images or the current user’s own pending upload. Pending uploads now live in a temp folder scoped to the user who uploaded them. Path traversal in the image path is rejected. Together they point to old code that did not check which gallery, or whose upload, an image belonged to. How far that reached is still unknown.

The same release also fixes non-security Gallery bugs, including, in the vendor’s words, “Fixed the Gallery field showing images that another user uploaded but had not saved yet”, and Gallery uploads that were never saved staying in Joomla’s temporary folder.

Which ACF for Joomla Versions Are Affected?

Every Advanced Custom Fields for Joomla version before 3.1.9 is affected. Tassos gives no first affected version, only that 3.1.9 is the fix, so treat anything older as needing the update. There is no CVE, no CVSS score, no researcher credit and no word on exploitation.

Check the version on the System - ACF plugin (plg_system_acf). The individual ACF field plugins all report 1.0, whatever release you run. That catches people out when they look at the Map field plugin in particular, because the fix is in the framework and the Map field plugin only changed its version headers.

The framework is shared, and any Tassos extension can install a newer copy of it. A site that updated another Tassos extension today may already have framework 6.1.51 while ACF itself still reads 3.1.8. Update ACF to 3.1.9 anyway, so the ACF plugins and the framework match and the site stops showing as affected.

What To Do Now

1. Update Advanced Custom Fields, Free or Pro, to 3.1.9 on every Joomla site that runs it, through Joomla’s Update tab or the mySites.guru mass updater.
2. Confirm the version afterwards on the System - ACF plugin (plg_system_acf), not on the field plugins.
3. If you let anyone other than trusted staff edit items with Map fields (front-end editing, user profile fields), open the Map fields on those items and look at the marker labels and addresses for script.
4. Check administrator accounts. A stored XSS that ran in an administrator’s browser can end with an account you did not create.

How mySites.guru Flags ACF on Joomla and WordPress

On 4 November 2026 we added a rule that flags every connected Joomla site running Advanced Custom Fields below 3.1.9. The version is read from the ACF system plugin, plg_system_acf, for the reason above. Most ACF sites we monitor were on 3.1.8 on release day, and a small share had already updated within hours. The flag works the same way as every other entry in our vulnerable extension list, alongside the security release flag on extension updates.

The WordPress side is covered from the same dashboard. Our WordPress vulnerability feed is imported from Wordfence, so the ACF Extended CVEs flag connected WordPress sites automatically, with no rule to write by hand. An agency running Joomla sites with Tassos ACF and WordPress sites with ACF Extended sees both lists in one place, and the mass updater pushes both updates. Every rule we hold is listed on the public vulnerabilities page, and all of this is part of the subscription.

The Last Tassos Security Release

This is the second Tassos security release this year that touches ACF. In March, CVE-2026-21627 in the Novarain/Tassos Framework was an unauthenticated file inclusion, deletion and SQL injection flaw scored CVSS 9.5, and ACF was one of the extensions bundling it. That one was fixed long ago and is a different flaw, but the pattern is the same: the framework is where the fix lives, and every Tassos extension that bundles it picks up the change. If a site skipped the March update, 3.1.9 is the moment to catch up on both.

Novarain Framework Vulnerability: Check Your Joomla Sites for nrframeworkCVE-2026-21627 (CVSS 9.5) in Tassos/Novarain Framework (plg_system_nrframework) for Joomla: unauthenticated file inclusion and SQL injection, fixed in 6.0.38.Read the full post

If a site has already been hit, or you would rather someone else made sure, fix.mySites.guru patches the site, audits it for backdoors and hands it back secure for a single fixed fee, usually the same day.