CVE-2026-94264
Description
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
How to fix
- Advanced Custom Fields: Extended0.9.2.8 or later
- Advanced Custom Fields: Extended PRO0.9.2.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Advanced Custom Fields: Extended | 0.8.9.4 ≤ v < 0.9.2.8 | 0.9.2.8 |
| Advanced Custom Fields: Extended PRO | 0.8.9.4 ≤ v < 0.9.2.8 | 0.9.2.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.