Proof of concept
- Add a new ACF field group
- Add a new table-type field to that field group
- Create a new post/page, wherever the field group is set to display
- Enter “<script>alert(1)</script>” into a field and save the post
Tested with ACF PRO v5. Not tested with v4.
Update to version 1.1.13 or later.