All vulnerabilities
CVE-2026-94264

Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes

Unknown Advanced Custom Fields: Extended
Open in ThreatlineRecord JSON
CVSS
6.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.9.2.8Fixed versionCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 0.9.2.8Advanced Custom Fields: ExtendedCVE List
  • 0.9.2.8Advanced Custom Fields: Extended PROCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.

Text from CVE List

Affected versions 2

  • Advanced Custom Fields: Extendedaffected: 0.8.9.4 before 0.9.2.8CVE List
  • Advanced Custom Fields: Extended PROaffected: 0.8.9.4 before 0.9.2.8CVE List

References 1