blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-94263

MEDIUM 4.8 CVSS 3.1
Published
October 23, 2026
Last modified
October 23, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-74
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.

Affected WordPress components

  • Advanced Custom Fields: Extended Plugin · acf-extended
    Possible match Active
    From 0.9.2.4 (including) to 0.9.2.8 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Advanced Custom Fields: Extended — From 0.9.2.4 (including) to 0.9.2.8 (excluding)
  • Unknown Advanced Custom Fields: Extended PRO — From 0.9.2.4 (including) to 0.9.2.8 (excluding)

References

  • wpscan.com https://wpscan.com/vulnerability/52f1633a-21ae-4273-8f24-5c10c2a92a8b/
  • nvd.nist.gov Official NVD record