What’s Vulnerable › Vulnerabilities
CVE-2026-94264: Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-23 · updated 2026-10-23
- Weakness: CWE-79
Description
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
Affected products
- Advanced Custom Fields: Extended: from 0.8.9.4 before 0.9.2.8 — fixed in 0.9.2.8
- Advanced Custom Fields: Extended PRO: from 0.8.9.4 before 0.9.2.8 — fixed in 0.9.2.8
How to fix
Upgrade to a fixed version: Advanced Custom Fields: Extended 0.9.2.8; Advanced Custom Fields: Extended PRO 0.9.2.8. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-94264 or the next vulnerability affects your stack