Is my site affected?
Your site is affected if it runs Tassos Advanced Custom Fields in any of these ranges:
- from 3.0.0 up to but not including 3.1.9
- from 3.1.4 up to but not including 3.1.9
- before 2.8.16
- from 2.8.13 up to but not including 2.8.16
- Latest safe version
- 3.1.9 or later. No rule we check matches that release or any newer one.
- What to do
- Update Tassos Advanced Custom Fields to 3.1.9 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.
Tassos Advanced Custom Fields (plg_system_acf) below 3.1.9 and below 2.8.16 - CVE-2026-115452 Authenticated Stored XSS in Map Marker Labels
Advanced Custom Fields for Joomla by Tassos Marinos (Free and Pro) has two security flaws. CVE-2026-115452 (CVSS 4.0 7.5 High) is a stored cross-site scripting flaw in the Map field's marker labels (Free and Pro): a user who can edit a Map marker label, such as an article author, can add a script that runs for anyone who opens the marker. The CVE lists 3.0.0 to 3.1.8 and 2.8.2 to 2.8.15 as affected. The second flaw, in the Gallery field's image removal, is CVE-2026-115451 and has its own rule. The vendor fixed both in 3.1.9 for Joomla 4 and later (4 November 2026) and in 2.8.16 for Joomla 3 (5 November 2026). The fixes are in the bundled Tassos Framework: marker labels and addresses are now filtered for scripts and event handlers, and an image can only be removed from a gallery when the server issued a token for it. This is the Joomla extension from tassos.gr, NOT the WordPress plugin Advanced Custom Fields or its Advanced Custom Fields: Extended add-on. On Joomla 4, 5 or 6 update Advanced Custom Fields to 3.1.9 or later; on Joomla 3 update to 2.8.16.
Affected versions: ≥ 3.0.0 and < 3.1.9
Full advisory: our disclosure post
Tassos Advanced Custom Fields (plg_system_acf) below 3.1.9 and below 2.8.16 - CVE-2026-115452 Authenticated Stored XSS in Map Marker Labels
Advanced Custom Fields for Joomla by Tassos Marinos (Free and Pro) has two security flaws. CVE-2026-115452 (CVSS 4.0 7.5 High) is a stored cross-site scripting flaw in the Map field's marker labels (Free and Pro): a user who can edit a Map marker label, such as an article author, can add a script that runs for anyone who opens the marker. The CVE lists 3.0.0 to 3.1.8 and 2.8.2 to 2.8.15 as affected. The second flaw, in the Gallery field's image removal, is CVE-2026-115451 and has its own rule. The vendor fixed both in 3.1.9 for Joomla 4 and later (4 November 2026) and in 2.8.16 for Joomla 3 (5 November 2026). The fixes are in the bundled Tassos Framework: marker labels and addresses are now filtered for scripts and event handlers, and an image can only be removed from a gallery when the server issued a token for it. This is the Joomla extension from tassos.gr, NOT the WordPress plugin Advanced Custom Fields or its Advanced Custom Fields: Extended add-on. On Joomla 4, 5 or 6 update Advanced Custom Fields to 3.1.9 or later; on Joomla 3 update to 2.8.16.
Affected versions: < 2.8.16
Full advisory: our disclosure post
Tassos Advanced Custom Fields (plg_system_acf) 3.1.4 to 3.1.8 and 2.8.13 to 2.8.15 - CVE-2026-115451 Unauthenticated Gallery Image Deletion
CVE-2026-115451 (CVSS 4.0 6.9 Medium) is an improper access control flaw in the Gallery field of Advanced Custom Fields for Joomla by Tassos Marinos. Anyone, without logging in, could delete images in the Gallery folders, including images already shown on published articles and modules. In ACF 3.1.7 and 3.1.8, users could also see, remove or save each other's unsaved uploads. The CVE lists ACF 3.1.4 to 3.1.8 and 2.8.13 to 2.8.15 as affected and credits Michael Nielsen. The vendor fixed it in 3.1.9 for Joomla 4 and later (4 November 2026) and in 2.8.16 for Joomla 3 (5 November 2026): an image can now only be removed from a gallery when the server issued a token for it. This is the Joomla extension from tassos.gr, NOT the WordPress plugin Advanced Custom Fields. On Joomla 4, 5 or 6 update Advanced Custom Fields to 3.1.9 or later; on Joomla 3 update to 2.8.16.
Affected versions: ≥ 3.1.4 and < 3.1.9
Full advisory: our disclosure post
Tassos Advanced Custom Fields (plg_system_acf) 3.1.4 to 3.1.8 and 2.8.13 to 2.8.15 - CVE-2026-115451 Unauthenticated Gallery Image Deletion
CVE-2026-115451 (CVSS 4.0 6.9 Medium) is an improper access control flaw in the Gallery field of Advanced Custom Fields for Joomla by Tassos Marinos. Anyone, without logging in, could delete images in the Gallery folders, including images already shown on published articles and modules. In ACF 3.1.7 and 3.1.8, users could also see, remove or save each other's unsaved uploads. The CVE lists ACF 3.1.4 to 3.1.8 and 2.8.13 to 2.8.15 as affected and credits Michael Nielsen. The vendor fixed it in 3.1.9 for Joomla 4 and later (4 November 2026) and in 2.8.16 for Joomla 3 (5 November 2026): an image can now only be removed from a gallery when the server issued a token for it. This is the Joomla extension from tassos.gr, NOT the WordPress plugin Advanced Custom Fields. On Joomla 4, 5 or 6 update Advanced Custom Fields to 3.1.9 or later; on Joomla 3 update to 2.8.16.
Affected versions: ≥ 2.8.13 and < 2.8.16
Full advisory: our disclosure post
Each CVE page above links its official cve.org record and its NVD entry.
Running Tassos Advanced Custom Fields on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
CVE identifiers: CVE-2026-115452, CVE-2026-115451. Rules current as of 15 November 2026.