CVE-2026-94263
Medium
Description
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
SeverityMedium
CVSS4.8
Exploit probability—
ProductAdvanced Custom Fields: Extended
PublishedOct 23, 2026
First seenOct 23, 2026
Weakness typeCWE-74Injection
How to fix
Update
- Advanced Custom Fields: Extended0.9.2.8 or later
- Advanced Custom Fields: Extended PRO0.9.2.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Advanced Custom Fields: Extended | 0.9.2.4 ≤ v < 0.9.2.8 | 0.9.2.8 |
| Advanced Custom Fields: Extended PRO | 0.9.2.4 ≤ v < 0.9.2.8 | 0.9.2.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.