{"id":"CVE-2026-94264","kind":"vulnerability","aliases":["CVE-2026-94264"],"related":[],"title":"WordPress ACF Extended plugins: shortcode attributes allow stored script injection","description":"The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator.\nThis is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.","summary":"The Advanced Custom Fields: Extended and Extended PRO WordPress plugins before 0.9.2.8 output some form shortcode attribute values without escaping or validation. A contributor-level user can craft a link or page that runs arbitrary script in the browser of anyone who opens it, including a logged-in administrator.","severity":"medium","cvss":6.8,"epss":0.00153,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["acf-extended","package","wordpress","wordpress-plugins"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed version of Advanced Custom Fields: Extended and Extended PRO in the WordPress plugins screen or with `wp plugin list`\n- Confirm whether the site has contributor-level or higher accounts that can create content with form shortcodes","fix":"- Update Advanced Custom Fields: Extended and Extended PRO to `0.9.2.8` or later\n- Until updated, restrict contributor accounts and review pages that use form shortcodes","status":"open","published_at":"2026-10-23T06:17:08+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:42:46+00:00","updated_at":"2026-10-25T03:42:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:42:46Z","model":"claude-haiku-5-5","output":{"fix":"- Update Advanced Custom Fields: Extended and Extended PRO to `0.9.2.8` or later\n- Until updated, restrict contributor accounts and review pages that use form shortcodes","reach":"internet","title":"WordPress ACF Extended plugins: shortcode attributes allow stored script injection","impact":"medium","summary":"The Advanced Custom Fields: Extended and Extended PRO WordPress plugins before 0.9.2.8 output some form shortcode attribute values without escaping or validation. A contributor-level user can craft a link or page that runs arbitrary script in the browser of anyone who opens it, including a logged-in administrator.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","acf-extended"],"confidence":0.7,"needs_auth":"yes","worst_case":"Script runs in an administrator's browser and can take over the site","analyst_note":"","how_to_check":"- Check the installed version of Advanced Custom Fields: Extended and Extended PRO in the WordPress plugins screen or with `wp plugin list`\n- Confirm whether the site has contributor-level or higher accounts that can create content with form shortcodes","needs_analyst":false,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running Advanced Custom Fields: Extended or Extended PRO before 0.9.2.8 that have contributor or higher accounts able to place form shortcodes. The flaw is reached through a crafted link, so any site with the plugin and open accounts is in scope. Sites without these plugins can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000645,"input_tokens":3480,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2023':164C '-2026':12A,15A '-5292':165C '-94264':13A,16A '0.9.2.8':36B,84C,93C 'acf':2A,18B 'acf-extend':17B 'administr':75B,156C 'advanc':26B,77C,85C 'allow':7A,124C 'anyon':66B,142C 'arbitrari':60B,135C 'attribut':6A,41B,104C,176C 'browser':64B,140C 'contributor':49B,132C 'contributor-level':48B 'cover':170C 'craft':53B,147C 'custom':27B,78C,86C 'cve':11A,14A,163C 'deni':168C 'deny-list':167C 'escap':44B,98C,123C 'extend':3A,19B,29B,31B,80C,88C 'field':28B,79C,87C 'fix':161C 'form':39B,102C 'html':174C 'includ':70B,151C 'incomplet':160C 'inject':10A 'led':143C 'level':50B 'link':55B,148C 'list':169C 'log':73B,154C 'logged-in':72B,153C 'low':130C 'open':68B,145C 'output':37B,121C 'packag':20B 'page':57B,150C 'plugin':4A,24B,34B,82C,91C 'point':108C 'pro':32B,89C 'request':117C 'role':128C 'run':59B,137C 'script':9A,61B,136C 'shortcod':5A,40B,103C 'store':8A 'taken':111C 'three':173C 'user':51B,125C 'valid':46B,96C 'valu':42B,110C 'visitor':114C 'whose':166C 'without':43B,122C 'wordpress':1A,21B,23B,33B,81C,90C 'wordpress-plugin':22B 'wrapper':175C","nicknames":[],"mitigations":[],"who_affected":"Sites running Advanced Custom Fields: Extended or Extended PRO before 0.9.2.8 that have contributor or higher accounts able to place form shortcodes. The flaw is reached through a crafted link, so any site with the plugin and open accounts is in scope. Sites without these plugins can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T06:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94264","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94264","severity":null,"published_at":"2026-10-23T06:17:08+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-94264","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94264","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}