---
id: "CVE-2026-94264"
kind: "vulnerability"
aliases: ["CVE-2026-94264"]
title: "WordPress ACF Extended plugins: shortcode attributes allow stored script injection"
severity: "medium"
cvss: 6.8
epss: 0.00153
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["acf-extended", "package", "wordpress", "wordpress-plugins"]
not_affected_if: ["patched-version", "plugin-not-installed"]
published_at: "2026-10-23T06:17:08+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:42:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94264", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-94264", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# WordPress ACF Extended plugins: shortcode attributes allow stored script injection

The Advanced Custom Fields: Extended and Extended PRO WordPress plugins before 0.9.2.8 output some form shortcode attribute values without escaping or validation. A contributor-level user can craft a link or page that runs arbitrary script in the browser of anyone who opens it, including a logged-in administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of Advanced Custom Fields: Extended and Extended PRO in the WordPress plugins screen or with `wp plugin list`
- Confirm whether the site has contributor-level or higher accounts that can create content with form shortcodes

## Fix

- Update Advanced Custom Fields: Extended and Extended PRO to `0.9.2.8` or later
- Until updated, restrict contributor accounts and review pages that use form shortcodes

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94264
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-94264

## From the sources

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator.
This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_